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DIRECTED RETRY METHOD FOR USE IN A 
WIRELESS LOCATION 

CROSS REFERENCE TO RELATED APPLICATIONS 

This is a continuation of U.S. Patent Application Serial No. (attorney docket ACOM- 

0091), filed on January 8, 1999, entitled "Calibration for Wireless Location System." 

FIELD OF THE INVENTION 

The present invention relates generally to methods and apparatus for locating wireless 
transmitters, such as those used in analog or digital cellular systems, personnel 
communications systems (PCS), enhanced specialized mobile radios (ESMRs), and other 
types of wireless communications systems. This field is now generally known as wireless 
location, and has application for Wireless E9-1-1, fleet management, RF optimization, and 
other valuable applications. 

BACKGROUND OF THE INVENTION 

Early work relating to the present invention has been described in U.S. Patent Number 
5,327,144, July 5, 1994, "Cellular Telephone Location System," which discloses a system 
for locating cellular telephones using novel time difference of arrival (TDOA) techniques. 
Further enhancements of the system disclosed in the '144 patent are disclosed in U.S. 
Patent Number 5,608,410, March 4, 1997, "System for Locating a Source of Bursty 
Transmissions." Both patents are owned by the assignee of the current invention, and both 
are incorporated herein by reference. The present inventors have continued to develop * 
significant enhancements to the original inventive concepts and have developed 
techniques to further improve the accuracy of Wireless Location Systems while 
significantly reducing the cost of these systems. 

Over the past few years, the cellular industry has increased the number of air interface 
protocols available for use by wireless telephones, increased the number of frequency 
bands in which wireless or mobile telephones may operate, and expanded the number of 
terms that refer or relate to mobile telephones to include "personal communications 

services", 4< wireless", and others. The air interface protocols now include AMPS, N- 

l 
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AMPS, TDMA, CDMA, GSM,TACS, ESMR, and others. The changes in terminology and 
increases in the number of air interfaces do not change the basic principles and inventions 
discovered and enhanced by the inventors. However, in keeping with the current 
terminology of the industry, the inventors now call the system described herein a Wireless 
5 Location System. 

The inventors have conducted extensive experiments with the Wireless Location Systein 
technology disclosed herein to demonstrate both the viability and value of the technology. 
For example, several experiments were conducted during several months of 1995 and 

10 1996 in the cities ofPhiladelphia and Baltimore to verify the system's ability to mitigate 
multipath in large urban environments. Then, in 1996 the inventors constructed a system 
in Houston that was used to test the technology's effectiveness in that area and its ability 
to interface directly with E9-1-1 systems. Then, in 1997, the system was tested in a 350 
square mile area in New Jersey and was used to locate real 9-1-1 calls from real people in 

15 trouble. Since that time, the system test has been expanded to include 125 cell sites 

covering an area of over 2,000 square miles. During all of these tests, techniques discussed 
and disclosed herein were tested for effectiveness and further developed, and the system 
has been demonstrated to overcome the limitations of other approaches that have been 
proposed for locating wireless telephones. Indeed, as of December, 1998, no other 

20 Wireless Location System has been installed anywhere else in the world that is capable of 
locating live 9-1-1 callers. The innovation of the Wireless Location System disclosed 
herein has been acknowledged in the wireless industry by the extensive amount of media 
coverage given to the system's capabilities, as well as by awards. For example, the 
prestigious Wireless Appy Award was granted to the system by the Cellular Telephone 

25 Industry Association in October, 1997, and the Christopher Columbus Fellowship 

Foundation and Discover Magazine found the Wireless Location System to be one of the 
top 4 innovations of 1998 out of 4,000 nominations submitted. 

The value and importance of the Wireless Location System has been acknowledged by the 
30 wifeless communications industry. In June 1996, the Federal Communications 

Commission issued requirements for the wireleis communications industry to deploy 
location systems for use in locating wireless 9-1-1 callers, with a deadline of October 
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2001. The location of wireless E9- 1-1 callers will save response time, save lives, and save 
enormous costs because of reduced use of emergency responses resources. In addition, 
numerous surveys and studies have concluded that various wireless applications, such as 
location sensitive billing, fleet management, and others, will have great commercial values 
5 in the coming years. 

Background on Wireless Communications Systems 

There are many different types of air interface protocols used for wireless communications 
systems. These protocols are used in different frequency bands, both in the U.S. and 
10 internationally. The frequency band does not impact the Wireless Location System's 
effectiveness at locating wireless telephones. 

All air interface protocols use two types of "channels" The first type includes control 
channels that are used for conveying information about the wireless telephone or 

1 5 transmitter, for initiating or terminating calls, or for transferring bursty data. For example, 
some types of short messaging services transfer data over the control channel In different 
air interfaces, control channels are known by different terminology, but the use of the 
control channels in each air interface is similar. Control channels generally have 
identifying information about the wireless telephone or transmitter contained in the 

20 transmission. 

The second type includes voice channels that are typically used for conveying voice 
communications over the air interface. These channels are only used after a call has been 
set up using the control channels. Voice channels will typically use dedicated resources 

25 within the wireless communications system whereas control channels will use shared 
resources. This distinction will generally make the use of control channels for wireless 
location purposes more cost effective than the use of voice channels, although there are 
some applications for which regular location on the voice channel is desired. Voice 
channels generally do not have identifying information about the wireless telephone or 

30 transmitter in the transmission. Some of the differences in the air interface protocols are 
discussed below: 



3 
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AMPS -This is the original air interface protocol used for cellular communications in the 
XLS. In the AMPS system, separate dedicated channels are assigned for use by control 
channels (RCC). According to the TIA/EIA Standard IS-553A, every control channel 
block must begin at cellular channel 333 or 334, but the block may be of variable length. 
In the U.S., by convention, the AMPS control channel block is 21 channels wide, but the 
use of a 26-channel block is also known. A reverse voice channel (RVC) may occupy any 
channel that is not assigned to a control channel. The control channel modulation is FSK 
(frequency shift keying), while the voice channels are modulated using FM (frequency 
modulation). 

N-AMPS - This air interface is an expansion of the AMPS air interface protocol, and is 
defined in EIA/TIA standard IS-88. The control channels are substantially the same as for 
AMP'S, however, the voice channels are different. The voice channels occupy less than 10 
KHz of bandwidth, versus the 30 KHz used for AMPS * and the modulation is FM* 

TDMA - This interface is also known D-AMPS, and is defined m EIA/TIA standard IS- 
136. This air interface is characterized by the use of both frequency and time separation, 
Control channels are known as Digital Control Channels (DCCH) and are transmitted in 
bursts in timeslots assigned for use by DCCH. Unlike AMPS, DCCH may be assigned 
anywhere in the frequency band, although there are generally some frequency assignments 
that are more attractive than others based upon the use of probability blocks. Voice 
channels are known as Digital Traffic Channels (DTC). DCCH and DTC may occupy the 
same frequency assignments, but not the same timeslot assignment in a given frequency 
assignment. DCCH and DTC use the same modulation scheme, known as 7i/4 DQPSK. 
(differential quadrature phase shift keying). In the cellular band, a carrier may use both the 
AMPS and TDMA protocols, as long as the frequency assignments for each protocol are 
kept separated. 

CDMA - This air interface is defined by EIA/TIA standard IS-95A. This air interface is 

characterized by the use of both frequency and code separation. However, because 

adjacent cell sites may use the same frequency sets, CDMA is also characterized by very 

careful power control. This careful power control leads to a situation known to those 

4 
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skilled in the art as the near-far problem, which makes wireless location difficult for most 
approaches to function properly. Control channels are known as Access Channels, and 
voice channels are known as Traffic Channels. Access and Traffic Channels may share the 
same frequency band, but are separated by code. Access and Traffic Channels use the 
5 same modulation scheme, known as OQPSK. 

GSM - This air interface is defined by the international standard Global System for Mobile 
Communications. Like TDMA, GSM is characterized by the use of both frequency and 
time separation. The channel bandwidth is 200 KHz, which is wide 

10 for TDMA. Control channels are known as Standalone Dedicated Control Channels 

(SDCCH), and are transmitted in bursts in timeslots assigned for use by SDCCH. SDCCH 
may be assigned anywhere in the frequency band. Voice channels are known as Traffic 
Channels (TCH). SDCCH and TCH may occupy the same frequency assignments, but not 
the same timeslot assignment in a given frequency assignment. SDCCH and TCH use the 

15 same modulation scheme, known as GMSK. 

Within this specification the reference to any one of the air interfaces shall automatically 
refer to all of the air interfaces, unless specified otherwise. Additionally, a reference to 
control channels or voice channels shall refer to all types of control or voice channels, 
20 whatever the preferred terminology for a particular air interface. Finally, there are many 
more types of air interfaces used throughout the world, and there is no intent to exclude 
any air interface from the inventive concepts described within this specification. Indeed, 
those skilled in the art will recognize other interfaces used elsewhere are derivatives of or 
similar in class to those described above. 

25 

The preferred embodiments of the inventions disclosed herein have many advantages over 
other techniques for locating wireless telephones. For example, some of these other 
techniques involve adding GPS functionality to telephones, which requires that significant 
changes be made to the telephones. The preferred embodiments disclosed herein do not 
30 require any changes to wireless telephones, and so they can be used in connection with the 
current installed base of over 65 million wireless telephones in the U.S. and 250 million 
wireless telephones worldwide. 
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SUMMARY OF THE INVENTION 

The present invention relates to a "directed retry" method for use in connection with a 
dual-mode wireless communications system supporting at least a first modulation method 
and a second modulation method. In such a situation, the first and second modulation 
methods are assumed to be used on different RF channels, the channels could be, for 
example, for a wireless communications system supporting a Wireless Location System 
and a PCS system, respectively. 

For example, the directed retry method could be used in a system in which there are an 
insufficient number of base stations to support a Wireless Location System, but which is 
operating in a region served by a Wireless Location System associated with another 
wireless communications system, A "first" wireless communications system could be a 
cellular telephone system and a "second" wireless communications system could be a PCS 
system operating within the same territory as the first system. According to the invention, 
when the wireless transmitter is currently using the second (PCS) modulation method and 
attempts to originate a call to 91 1 , the wireless transmitter is caused to switch 
automatically to the first modulation method, arid then to originate the call to 91 1 using 
the first modulation method on one of the set of RF channels prescribed for use by the first 
wireless communications system. 

Other details of the invention are described below. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Figures 1 and 1A schematically depict a Wireless Location System in accordance with the 
present invention. 

Figure 2 schematically depicts a Signal Collection System (SCS) 10 in accordance with 
the present invention. 

Figure 2A schematically depicts a receiver module 10-2 employed by the Signal 
Collection System. 

6 
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Figures 2B and 2C schematically depict alternative ways of coupling the receiver 
module(s) 10-2 to the antennas 10-1. 

5 Figure 2C-1 is a flowchart of a process employed by the Wireless Location System when 
using narrowband receiver modules. 

Figure 2D schematically depicts a DSP module 10-3 employed in the Signal Collection 
System in accordance with the present invention, 

10 

Figure 2E is a flowchart of the operation of the DSP module(s) 1 0-3, and Figure 2E-1 is a 
flowchart of the process employed by the DSP modules for detecting active channels. 

Figure 2F schematically depicts a Control and Communications Module 1 0-5 in 
1 5 accordance with the present invention. 

Figures 2G-2J depict aspects of the presently preferred SCS calibration methods. Figure 
2G is a schematic illustration of baselines and error values used to explain an external 
calibration method in accordance with the present invention. Figure 2H is a flowchart of 
20 an internal calibration method. Figure 21 is an exemplary transfer function of an AMPS 
control channel aiid Figure 2J depicts an exemplary comb signal. 

Figures 2K and 2L are flowcharts of two methods for monitoring performance of a 
Wireless Location System in accordance with the present invention, 

25 

Figure 3 schematically depicts a TDOA Location Processor 12 in accordance with the 
present invention. 

Figure 3 A depicts the structure of an exemplary network map maintained by the TLP 
30 controllers in accordance with the present invention. 
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Figures 4 and 4A schematically depict different aspects of an Applications Processor 14 in 
accordance with the present invention. 

Figure 5 is a flowchart of a central station-based location processing method in accordance 
5 with the present invention. 

Figure 6 is a flowchart of a station-based location processing method in accordance with 
the present invention. 

1 o Figure 7 is a flowchart of a method for determining, for each transmission for which a 
location is desired, whether to employ central or station-based processing. 

Figure 8 is a flowchart of a dynamic process used to select cooperating antennas and 
SCS's 1 0 used in location processing. 

15 

Figure 9 is diagram that is referred to below in explaining a method for selecting a 
candidate list of SCS's and antennas using a predetermined set of criteria. 

Figures 10A and 10B are flowcharts of alternative methods for increasing the bandwidth 
20 of a transmitted signal to improve location accuracy. 

Figures 1 1 A-l lC are signal flow diagrams and Figure 1 ID is a flowchart, and they are 
used to explain an inventive method for combining multiple statistically independent 
location estimates to provide an estimate with improved accuracy. 

25 

Figures 12A and 12B are a block diagram and a graph, respectively, for explaining a 
bandwidth synthesis method. 

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 

30 The Wireless Location System (Wireless Location System) operates as a passive overlay 

to a wireless communications system, such as a cellular, PCS, or ESMR system, although 

the concepts are not limited to just those types of communications systems. Wireless 

8 
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communications systems are generally not suitable for locating wireless devices because 
the designs of the wireless transmitters and cell sites do not include the necessary 
functionality to achieve accurate location. Accurate location in this application is defined 
as accuracy of 1 00 to 400 feet RMS (root mean square). This is dTstinguished from the 
location accuracy that can be achieved by existing cell sites, which is generally limited to 
the radius of the cell site. In general, cell sites are not designed or programmed to 
cooperate between and among themselves to determine wireless transmitter location. 
Additionally, wireless transmitters such as cellular and PCS telephones are designed to be 
low cost and therefore generally do not have locating capability built-in. The Wireless 
Location System is designed to be a low cost addition to a wireless coriimunications 
system that involves minimal changes to cell sites and no changes at all to standard 
wireless transmitters; The Wireless Location System is passive because the it does riot 
contain transmitters, and therefore cannot cause interference of any kind to the wireless 
communications system. The Wireless Location System uses only its own specialized 
receivers at cell sites or other receiving locations. 

Overview of Wireless Location System (Wirfeless Location System) 
As shown in Figure 1, the Wireless Location System has four major lands of subsystems: 
the Signal Collection Systems (SCS's) 10, the tDOA Location Processors (TLP's) 12, the 
Application Processors (AP's) 14, and the NetWork Operations Console (NOC) 16* Each 
* SCS is responsible for receiving the RF signals transmitted by the wireless transmitters on 
both control channels and voice channels* In general, each SCS is preferably installed at a 
wireless carrier's cell site, and therefore opeMtes in parallel to a base station. Each TLF 12 
is responsible for managing a network of SCS's 10 and for providing a centralized pool of 
digital signal processing (DSP) resources that can be used in the location calculations. The 
SCS's 10 and the TLP's 12 operate together to determine the location of the wireless 
transmitters, as will be discussed more fully below. Digital signal processing is the 
preferable manner in which to process radio signals because DSP's are relatively low cost, 
provide consistent performance, and are easily re-programmable to handle many different 
tasks. Both the SCS's 10 and TLP's 12 cont^fi a significant amount ofDSP resources, and 
the software in these systems can operate dyriMically to determine where to perform a 

particular processing function based upon tradeoffs in processing time, communications 

. 9 
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time, queuing time, and cost Each TLP 12 exists centrally primarily to reduce the overall 
cost of implementing the Wireless Location System, although the techniques discussed 
herein are not limited to the preferred architecture shown. That is, DSP resources can be 
relocated within the Wireless Location System without changing the basic concepts and 
functionality disclosed. 

The AP's 14 are responsible for managing all of the resources in the Wireless Location 
System, including all of the SCS's 10 andTLP's 12. Each AP 14 also contains a 
specialized database that contains "triggers" for the Wireless Location System. In order to 
conserve resources, the Wireless Location System can be programmed to locate only 
certain predetermined types of transmissions. When a transmission of a predetermined 
type occurs, then the Wireless Location System is triggered to begin location processing. 
Otherwise, the Wireless Location System may be programmed to ignore the transmission, 
Each AP 14 also contains applications interfaces that permit a variety of applications to 
securely access the Wireless Location System. These applications may, for example, 
access location records in real time or non-real time, create or delete certain type of 
triggers, or cause the Wireless Location System to take other actions. Each AP 14 is also 
capable of certain post-processing functions that allow the AP 14 to combine a number of 
location records to generate extended reports or analyses useful for applications such as 
traffic monitoring or RF optimization. 

The NOC 16 is a network management system that provides operators of the Wireless 

Location System easy access to the programming parameters of the Wireless Location * 

System. For example, in some cities, the Wireless Location System may contain many 

hundreds or even thousands of SCS's 10. The NOC is the most effective way to manage a 

large Wireless Location System, using graphical user interface capabilities. The NOC will 

also receive real time alerts if certain functions within the Wireless Location System are 

not operating properly. These real time alerts can be used by the operator to take 

corrective action quickly and prevent a degradation of location service. Experience with 

trials of the Wireless Location System show that the ability of the system to maintain good 

location accuracy over time is directly related to the operator's ability to keep the system 

operating within its predetermined parameters. 

10 
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Readers of U.S. Patents 5,327, 144 and 5,608,410 and this specification will note 
similarities between the respective systems. Indeed, the system disclosed herein is 
significantly based upon and also significantly enhanced from the system described in 
those previous patents. For example, the SCS 10 has been expanded and enhanced from 
the Antenna Site System described in 5,608,410. The SCS 10 now has the capability to 
support many more antennas at a single cell site, and further can support the use of 
extended antennas as described below. This enables the SCS 10 to operate with the 
sectored cell sites now commonly used. The SCS 10 can also transfer data from multiple 
antennas at a cell site to the TLP 12 instead of always combining data from multiple 
antennas before transfer. Additionally, the SCS 1 0 can support multiple air interface 
protocols thereby allowing the SCS 10 to function even as a wireless carrier continually 
changes the configuration of its system. 

The TLP 12 is similar to the Central Site System disclosed in 5,608,410, but has also been 
expanded and enhanced. For example, the TLP 12 has been made scaleable so that the 
amount of DSP resources required by each TLP 12 can be appropriately scaled to match 
the number of locations p er second required by customers of the Wireless Location 
System. In order to support scaling for different Wireless Location System capacities, a 
networking scheme has been added to the TLP 12 so that multiple TLP's 12 can cooperate 
to share RF data across wireless communication system network boundaries. Additionally, 
the TLP 12 has been given control means to determine the SCS's 10, and more 
importantly the antennas at each of the SCS's 10, from which the TLP 12 is to receive data 
in order to process a specific location. Previously, the Antenna Site Systems automatically 
forwarded data to the Central Site System, whether requested or not by the Central Site 
System. Furthermore, the SCS 10 and TLP 12 combined have been designed with 
additional means for removing multipath from the received transmissions. 

The Database Subsystem of the Central Site System has been expanded and developed 

into the AP 14. The AP 14 can support a greater variety of applications than previously 

disclosed in 5,608,410, including the ability to post-process large volumes of location 

records from multiple wireless transmitters. This post-processed data can yield, for 

11 
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example, very effective maps for use by wireless carriers to improve and optimize the RF 
design of the communications systems. This can be achieved, for example, by plotting the 
locations of all of the callers in an area and the received signal strengths at a number of 
cell sites. The carrier can then determine whether each cell site is, in fact, serving the exact 
coverage area desired by the carrier. The AP 14 can also now store location records 
anonymously, that is, with the MIN and/or other identity information removed from the 
location record, so that the location record can be used for RF optimization or traffic 
monitoring without causing concerns about an individual user's privacy. 

As shown in Figure 1 A, a presently preferred implementation of the Wireless Location 
System includes a plurality of SCS regions each of which comprises multiple SCS's 1 0. 
For example, "SCS Region 1" includes SCS ! s 1 OA and 10B (and preferably others, not 
shown) that are located at respective cell sites and share antennas with the base stations at 
those cell sites. Drop and insert units 1 1A and 1 IB are used to interface fractional Tl/El 
lines to full Tl/El lines, which in turn are coupled to a digital access and control system 
(DACS) 13 A. The DAGS 13A and another DACS 13B are used in the manner described 
more fully below for communications between the SCS's 10A, 10B, etc., and multiple 
TLFs 12A, 12B, etc. As shown, the TLPs are typically collocated and interconnected via 
an Ethernet network (backbone) and a second, redundant Ethernet network. Also coupled 
to the Ethernet networks are multiple AP's 14A and 14B, multiple NOCs 16A and 16B, 
and a terminal server 15. Routers 19A and 19B are used to couple one Wireless Location 
System to one or more other Wireless Location System(s). 

Signal Collection System 10 

Generally, cell sites will have one of the following antenna configurations: (i) an 

omnidirectional site with 1 or 2 receive antennas or (ii) a sectored site with 1, 2, or 3 

sectors, and with 1 or 2 receive antennas used in each sector. As the number of cell sites 

has increased in the U.S. and internationally, sectored cell sites have become the 

predominant configuration. However, there are also a growing number of micro-cells and 

pico-cells, which can be omnidirectional. Therefore, the SCS 10 has been designed to be 

configurable for any of these typical cell sites and has been provided with mechanisms to 

employ any number of antennas at a cell site. 
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The basic architectural elements of the SCS 10 remain the same as for the Antenna Site 
System described in 5,608,410, but several enhancements have been made to increase the 
flexibility of the SCS 10 and to reduce the commercial deployment cost of the system. The 
most presently preferred embodiment of the SCS 10 is described herein. The SCS 10, an 
overview of which is shown in Figure 2, includes digital receiver modules 10-2 A through 
10-2C; DSP modules 10-3 A through 10-3C; a serial bus 10-4, a control and 
communications module 10-5; a GPS module 10-6; and a clock distribution module 10-7. 
The SCS 10 has the following external connections: power, fractional Tl/El 
communications, RF connections to antennas* and a GPS antenna connection for the 
timing generation (or clock distribution) module 10-7. The architecture and packaging of 
the SCS 10 permit it to be physically collocated with cell sites (which is the most common 
installation place), located at other types of towers (such as FM, AM, two-way emergency 
communications, television, etc.), or located at other building structures (such as rooftops, 
silos, etc.). 

Timing Generation 

The Wireless Location System depends upon the accurate determination of time at all 

SCS's 10 contained within a network. Several different timing generation systems have 

been described in previous disclosures, however the most presently preferred embodiment 

is based upon an enhanced GPS receiver 10-6. The enhanced GPS receiver differs from 

most traditional GPS receivers in that the receiver contains algorithms that remove some 

of the timing instability of the GPS signals, and guarantees that any two SCS's 10 

contained within a network can receive timing pulses that are within approximately ten 

nanoseconds of each other. These enhanced GPS receivers are now commercially 

available, and further reduce some of the time reference related errors that were observed 

in previous implementations of wireless location systems. While this enhanced GPS 

receiver can produce a very accurate time reference, the output of the receiver may still 

have an unacceptable phase noise. Therefore, the output of the receiver is input to a low 

phase noise, crystal oscillator-driven phase locked loop circuit that can now produce 10 

MHz and one pulse per second (PPS) reference signals with less than 0.01 degrees RMS 

of phase noise, and with the pulse output at any S CS 10 in a Wireless Location System 
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network within ten nanoseconds of any other pulse at another SCS 10. This combination 
of enhanced GPS receiver, crystal oscillator, arid phase locked loop is now the most 
preferred method to produce stable time and frequency reference signals with low phase 
noise. 

The SCS 10 has been designed to support multiple frequency bands and multiple carriers 
with equipment located at the same cell site. This can take place by using multiple 
receivers internal to a single SGS chassis, or by using multiple chassis each with separate 
receivers. In the event that multiple SCS chassis are placed at the same cell site, the SCS's 
10 can share a single timing generation/clock distribution circuit 10-7 and thereby reduce 
overall system cost The 10 MHz and one PPS output signals from the timing generation 
circuit are amplified and buffered internal to the SCS 10, and then made available via 
external connectors. Therefore a second SCS can receive its timing from a first SCS using 
the buffered output and the external connectors. These signals can also be made, available 
to base station equipment collocated at the cell site. This might be useful to the base 
station, for example, in improving the frequency re-use pattern of a wireless 
communications system. 

Receiver Module 1 0-2 (Wideband Embodiment) 

Wheal a wireless transmitter makes a transmission, the Wireless Location System must 

receive the transmission at multiple SCS's 10 located at multiple geographically dispersed 

cell sites. Therefore, each SCS 10 has the ability to receive a transmission on any RF 

channel on which the transmission may originate. Additionally, since the SCS 10 is 

capable of supporting multiple air interface protocols* the SCS 10 also supports multiple 

types of RF channels. This is in contrast to most current base station receivers, which 

typically receive only one type of channel arid are usually capable of receiving only on 

select RF channels at each cell site. For example, a typical TDMA base station receiver 

will only support 30 KHz wide channels, arid each receiver is programmed to receive 

signals on only a single channel whose frequency does hot change often (i.e. there is a 

relatively fixed frequency plan). Therefore, very few TDMA base station receivers would 

receive a transmission on any given frequency. As another example, even though some 

GSM base station receivers are capable of frequency hopping, the receivers at multiple 
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base stations are generally not capable of simultaneously tuning to a single frequency for 
the purpose of performing location processing. In fact, the receivers at GSM base stations 
are programmed to frequency hop to avoid using an RF channel that is being used by 
another transmitter so as to minimize interference. 

The SGS receiver module 1 0-2 is preferably a dual wideband digital receiver that can 
receive the entire frequency band and all of the RF channels of an air interface. For 
cellular systems in die U.S., this receiver module is either 15 MHz wide or 25 MHz wide 
so that all of the channels of a single carrier or all of the channels of both carriers can be 
received. This receiver module has many of the characteristics ofthe receiver previously 
described in Patent Number 5,608,410, and Figure 2A is a block diagram of the currently 
preferred embodiment. Each receiver module contains an RF tuner section 10-2-1, a data 
interface and control section 10-2-2 and an analog to digital conversion section 10-2-3. 
The RF tuner section 10-2-1 includes two full independent digital receivers (including 
Tuner #1 and Tuner #2) that convert the analog RF input from an external connector into a 
digitized data stream. Unlike most base station receivers, the SCS receiver module does 
not perform diversity combining or switching. Rather, the digitized signal from each 
independent receiver is made available to the location processing. The present inventors 
have determined that there is an advantage to the location processing, and especially the 
multipath mitigation processing, to independently process the signals from each antenna 
rather than perform combining on the receiver module. 

The receiver module 1 0-2 performs, or is coupled to elements that perform, the following 
functions: automatic gain control (to support both nearby strong signals and far away weak 
signals), bandpass filtering to remove potentially interfering signals from outside ofthe RF 
band of interest, synthesis of frequencies needed for mixing with the RF signals to create 
an IF signal that can be sampled, mixing, and analog to digital conversion (ADC) for 
sampling the RF signals and outputting a digitized data stream having an appropriate 
bandwidth and bit resolution. The frequency synthesizer locks the synthesized frequencies 
to the 10 MHz reference signal from the clock distribution/timing generation module 10-7 
(Figure 2). All of the circuits used in the receiver module maintain the low phase noise 
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characteristics of the timing reference signal The receiver module preferably has a 
spurious free dynamic range of at least 80 dB. 

The receiver module 10-2 also contains circuits to generate test frequencies and calibration 
signals, as well as test ports where measurements can be made by technicians during 
installation or troubleshooting. Various calibration processes are described in further detail 
below. The internally generated test frequencies and test ports provide an easy method for 
engineers and technicians to rapidly test the receiver module and diagnose any suspected 
problems. This is also especially useful during the manufacturing process. 

One of the advantages of the Wireless Location System described herein is that no new 
antennas are required at cell sites. The Wireless Location System can use the existing 
antennas already installed at most cell sites, including both omni-directional and sectored 
antennas, This feature can result in significant savings in the installation and maintenance 
costs of the Wireless Location System versus other approaches that have been described in 
the prior ait The SCS's digital receivers 10-2 can be connected to the existing antennas in 
two ways, as shown in Figures 2B and 2C, respectively. In Figure 2B, the SCS receivers 
10-2 are connected to the existing cell site multi-coupler or RF splitter. In this manner, the 
SCS 10 uses the cell site's existing low noise pre- amplifier, band pass filter, and multi- 
coupler or RF splitter. This type of connection usually limits the SCS 10 to supporting the 
frequency band of a single carrier. For example, an A-side cellular carrier will typically 
use the band pass filter to block signals frbm customers of the B-side earner, and Vice 
versa. • 

In Figure 2C, the existing RF path at the cell site has been interrupted, and a new pre- 
amplifier, band pass filter, and RF splitter has been added as part of the Wireless Location 
System. The new band pass filter will pass multiple contiguous frequency bands, such as 
both the A-side and B-side cellular carriers, thereby allowing the Wireless Location 
System to locate wireless transmitters using both cellular systems but using the antennas 
from a single cell site. In this configuration, the Wireless Location System uses matched 
RF components at each cell site, so that the phase versus frequency responses are 

identical. This is in contrast to existing RF components^ which may be from different 
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manufacturers or using different model numbers at various cell sites. Matching the 
response characteristics o f RF components reduces a possible source of error for the 
location processing, although the Wireless Location System has the capability to 
compensate for these sources of error Finally, the new pre-amplifier installed with the 
Wireless Location System will have a very low noise figure to improve the sensitivity of 
the SCS 10 at a cell site. The overall noise figure of the SCS digital receivers 10-2 is 
dominated by the noise figure of the low noise amplifiers. Because the Wireless Location 
System can use weak signals in location processing, whereas the base station typically 
cannot process weak signals, the Wireless Location System can significantly benefit from 
a high quality, very low noise amplifier. 

In order to improve the ability of the Wireless Location System to accurately determine 
TDOA for a wireless transmission, the phase versus frequency response of the cell site's 
RF components are determined at the time of installation and updated at other certain 
times and then stored in a table in the Wireless Location System, This can be important 
because, for example, the band pass filters and/or multi-couplers made by some 
manufacturers have a steep and non-linear phase versus frequency response near the edge 
of the pass band. If the edge of the pass band is very near to or coincident with the reverse 
control or voice channels, then the Wifeless Location System would make incorrect 
measurements of the transmitted signal's phase characteristics if the Wireless Location 
System did not correct the measurements using the stored characteristics. This becomes ^ 
even more important if a carrier has installed multi-couplers and/or band pass filters from 
more than one manufacturer, because the characteristics at each site may be different. In 
addition to measuring the phase versus frequency response, other environmental factors 
may cause changes to the RF path prior to the ADC. These factors require occasional and 
sometimes periodic calibration in the SCS 10. 

Alternative Narrowband Embodiment of Receiver Module 10-2 

In addition or as an alternative to the wideband receiver module, the SCS 10 also supports 
a narrowband embodiment of the receiver module 10-2. In contrast to the wideband 
receiver module that can simultaneously receive all of the RF channels in use by a wireless 
communications system, the narrowband receiver can only receive one or a few RF 
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channels at a time. For example, the SGS 10 supports a 60 Kjftz narrowband receiver for 
use in AMPS/TDMA systems, covering two contiguous 30 KHz channels. This receiver is 
still a digital receiver as described for the wideband module, however the frequency 
synthesizing and mixing circuits are used to dynamically tune the receiver module to 
various RF channels on command. This dynamic tuning can typically occur in one 
millisecond or less, and the receiver can dwell on a specific RF channel for as long as 
required to receive and digitize RF data for location processing. 

The purpose of the narrowband receiver is to reduce the implementation cost of a Wireless 
Location System from the cost that is incurred with wideband receivers. Of course, there is 
some loss of performance, but the availability of these multiple receivers permits wireless 
carriers to have more cost/performance options. Additional inventive functions and 
enhancements have been added to the Wireless Location System to support this new type 
of narrowband receiver. When the wideband receiver is being used, all RF channels are 
received continuously at all SCS's 1 0, and subsequent to the transmission, the Wireless 
Location System can use the DSP's 1 0-3 (Figure 2) to dynamically select any RF channel 
from the digital memory. With the narrowband receiver, the Wifeless Location System 
must ensure a priori that the narrowband receivers at multiple cell sites are simultaneously 
tuned to the same RF channel so that all receivers can simultaneously receive, digitize and 
store the same wireless transmission. For this reason, the narrowband receiver is generally 
used only for locating voice channel transmissions, which can be known a priori to be 
making a transmission. Since control channel transmissions can occur asynchronously at 
any time, the narrowband receiver may not be tuned to the correct channel to receive the 
transmission. 

When the narrowband receivers are used for locating AMPS voice channel transmissions, 

the Wireless Location System has the ability to temporarily change the modulation 

characteristics of the AMPS wireless transmitter to aid location processing. This may be 

necessary because AMPS voice channels are only FM modulated with the addition of a 

low level supervisory tone known as SAT, As is known in the art, the Cramer-Rao lower 

bound of AMPS FM modulation is significantly worse than the Manchester encoded FSK 

modulation used for AMPS reverse channels and "blank and burst" transmissions on the 
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voice channel. Further, AMPS wireless transmitters may be transmitting with significantly 
reduced energy if there is no modulating input signal (i.e., lib one is speaking). To improve 
the location estimate by improving the modulation characteristics without depending on 
the existence or amplitude of an input modulating signal, the Wireless Location System 
can cause an AMPS wireless transmitter to transmit a "blank and burst" message at a point 
in time when the narrowband receivers at multiple SCS's 10 are tuned to the RF channel 
on which the message will be sent. This is further described later. 

The Wireless Location System performs the following steps when using the narrowband 
receiver module (see the flowchart ofFigure 2C-1): 

a first wireless transmitter is a priori engaged in transmitting on a particular RF 
channel; 

the Wireless Location System triggers to make a location estimate of the first wireless 
transmitter (the trigger may occur either internally or externally via a 
command/response interface); 

the Wireless Location System determines the cell site, sector, RF channel, timeslot, 
long code mask, and encryption key (all information elements may not be 
necessary for all air interface protocols) currently in use by the first wireless 
transmitter; 

the Wireless Location System tunes an appropriate first narrowband receiver at an 
appropriate first SCS 10 to the RF channel and timeslot at the designated cell site 
and sector, where appropriate typically means both available arid collocated or in 
closest proximity; 

the first SCS 10 receives a time segment of RF data, typically ranging from a few 
microseconds to tens of milliseconds, from the first narrowband receiver and 
evaluates the transmission's power, SNR, and modulation characteristics; 

if the transmission's power or SNR is below a predetermined threshold, the Wireless 
Location System waits a predetermined length of time and then returns to the 
above third step (where the Wireless Location System determines the cell site, 
sector, etc.); 

if the transmission is an AMPS voice channel transmission and the modulation is 

below a threshold, then the Wireless Location System commands the wireless 
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communications system to send a command to the first wireless transmitter to 

cause a "blank and burst" on the first wireless transmitter; 
the Wireless Location System requests the wireless communications system to prevent 

hand-off of the wireless transmitter to another RF channel for a predetermined 
5 length of time; 

the Wireless Location System receives a response from the wireless communications 

system indicating the time period during which the first wireless transmitter will be 

prevented from handing-off, and if commanded, the time period during which the 

wireless communications system will send a command to the first wireless 
10 transmitter to cause a "blank and burst"; 

the Wireless Location System determines the list of antennas that will be used in 

location processing (the antenna selection process is described below); 
the Wireless Location System determines the earliest Wireless Location System 

timestamp at which the narrowband receivers connected to the selected antennas 
15 are available to begin simultaneously collecting RF data from the RF channel 

cuiTently in use by the first wireless transmitter; 
based upon the earliest Wireless Location System timestamp and the time periods in 

the response from the wireless communications system, the Wireless Location 

System commands the narrowband receivers connected to the antennas that will be 
20 used in location processing to tune to the cell site, sector, and RF channel currently 

in use by the first wireless transmitter and to receive RF data for a predetermined 

dwell time (based upon the bandwidth of the signal, SNR, and integration 

requirements); 

the RF data received by the narrowband receivers are written into the dual port 
25 memory; 

location processing on the received RF data commences, as described in Patent Nos. 

5,327,144 and 5,608,410 and in sections below; 
the Wireless Location System again determines the cell site, sector, RF channel, 
timeslot, long code mask, and encryption key currently in use by the first wireless 
30 transmitter; 

if the cell site, sector, RF channel, timeslot, long code mask, and encryption key 
currently in use by the first wireless transmitter has changed between queries (i.e. 
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before and after gathering the RF data) the Wireless Location System ceases 
location processing, causes ah alert message that location processing failed because 
the 'wireless transmitter changed transmission status during the period of time in 
which RF data was being received, and re-triggers this entire process; 
5 location processing on the received RF data completes in accordance with the steps 
described below. 

The determination of the information elements including cell site, sector, RF channel, 
timeslot, long code mask, and encryption key (all information elements may not be 
10 necessary for all air interface protocols) is typically obtained by the Wireless Location 
System through a command / response interface between the Wireless Location System 
and the wireless communications system. 

The use of the narrowband receiver in the manner described above is known as random 
15 tuning because the receivers can be directed to any RF channel on command from the 
system. One advantage to random tuning is that locations are processed only for those 
wireless transmitters for which the Wireless Location System is triggered. One 
disadvantage to random tuning is that various synchronization factors, including the 
interface between the wireless communications system and the Wireless Location System 
20 and the latency times in scheduling the necessary receivers throughout the system, can 
limit the total location processing throughput. For example, in a TDMA system, random 
tuning used throughout the Wireless Location System will typically limit location 
processing throughput to about 2.5 locations per second per cell site sector. 

25 Therefore,, the narrowband receiver also supports another mode, known as automatic 
sequential tuning, which can perform location processing at a higher throughput. For 
example, in a TDMA system, using similar assumptions about dwell time and setup time 
as for the narrowband receiver operation described above, sequential tuning can achieve a 
location processing throughput of about 41 locations per second per cell site sector, 

30 meaning that all 395 TDMA RF channels can be processed in about 9 seconds. This 
increased rate can be achieved by taking advantage of, for example, the two contiguous 
RF channels that can be received simultaneously, location processing all three TDMA 
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timeslots in an RF channel, and eliminating the need for synchronization with the wireless 
communications system. When the Wireless Location System is using the narrowband 
receivers for sequential tuning, the Wireless Location System has no knowledge of the 
identity of the wireless transmitter because the Wireless Location System does not wait for 
a trigger, nor does the Wireless Location System query the wireless communications 
system for the identity information prior to receiving the transmission. In this method, the 
Wireless Location System sequences through every cell site, RF channel and time slot, 
performs location processing, arid reports a location record identifying a time stamp, cell 
site, RF channel, time slot, and location. Subsequent to the location record report, the 
Wireless Location System and the wireless communications system match the location 
records to the wireless communications system's data indicating which wireless 
transmitters were in use at the time, and which cell sites, RF channels, and time slots were 
used by each wireless transmitter. Then, the Wireless Location System can retain the 
location records for wireless transmitters of interest, and discard those location records for 
the remaining wireless transmitters. 

Digital Signal Processor Module 10-3 

The SCS digital receiver modules 10-2 output a digitized RF data stream having a 
specified bandwidth and bit resolution, For example, a 15 MHz embodiment of the 
wideband receiver may output a data stream containing 60 million samples per second, at 
a resolution of 14 bits per sample. This RF data stream will contain all of the RF channels 
that are used by the wireless communications system. The DSP modules 10-3 receive the 
digitized data stream, and can extract any individual RF channel through digital mixing 
and filtering. The DSP's can also reduce the bit resolution upon command from the 
Wireless Location System, as needed to reduce the bandwidth requirements between the 
SCS 10 and TLP 12. The Wireless Location System can dynamically select the bit 
resolution at which to forward digitized baseband RF data, based upon the processing 
requirements for each location. DSP's are used for these functions to reduce the systemic 
errors that can occur from mixing and filtering with analog components. The use of DSP's 
allows perfect matching in the processing between any two SCS's 10. 
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A block diagram of the DSP module 10-3 is shown is Figure 2D, and the operation of the 
DSP module is depicted by the flowchart of Figure 2E. As shown in Figure 2D, the DSP 
module 10-3 comprises the following elements: a pair of DSP elements 10-3-1 A and 10-3- 
1B, referred to collectively as a "first" DSP; serial to parallel converters 10-3-2; dual port 
5 memory elements 10-3-3; a second DSP 10-3-4; a parallel to serial converter; a FIFO 
buffer; a DSP 10-3-5 (including RAM) for detection, another DSP 1 0-3-6 for 
demodulation, and another DSP 10-3-7 for normalization and control; and an address 
generator 10-3-8, In a presently preferred embodiment, the DSP module 10-3 receives the 
wideband digitized data stream (Figure 2E, step SI), and uses the first DSP (10-3-1 A and 

10 1 0-3-1B) to extract blocks of channels (step S2). For example, a first DSP programmed to 
operate as a digital drop receiver can extract four blocks of channels, where each block 
includes at least 1.25 MHz of bandwidth. This bandwidth can include 42 channels of 
AMPS or TDMA, 6 channels of GSM, or 1 channel of CDMA. The DSP does not require 
the blocks to be contiguous, as the DSP can independently digitally tune to any set of RF 

15 channels within the bandwidth of the wideband digitized data stream. The DSP can also 
perform wideband or narrow band energy detection on all or any of the channels in the 
block, and report the power levels by channel to the TLP 12 (step S3). For example, every 
10 ms, the DSP can perform wideband energy detection and create an RF spectral map for 
all channels for all receivers (see step S9). Because this spectral map can be sent from the 

20 SCS 10 to the TLP 12 every 10 ms via the communications link connecting the SCS 10 
and the TLP 12, a significant data overhead could exist Therefore, the DSP reduces the 
data overhead by companding the data into a finite number of levels. Normally, for 
example, 84 dB of dynamic range could require 14 bits. In the companding process 
implemented by the DSP, the data is reduced, for example, to only 4 bits by selecting 16 

25 important RF spectral levels to send to the TLP 12. The choice of the number of levels, 
and therefore the number of bits, as well as the representation of the levels, can be 
automatically adjusted by the Wireless Location System. These adjustments are performed 
to maximize the information value of the RF spectral messages sent to the TLP 12 as well 
as to optimize the use of the bandwidth available on the communications link between the 

30 SCS 10 and the TLP 12. 
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After conversion, each block of RF channels (each at least 1.25 MHz) is passed through 
serial to parallel converter 10-3-2 and then stored in dual port digital memory 10-3-3 (step 
S4). The digital memory is a circular memory, which means that the DSP module begins 
writing data into the first memory address and then continues sequentially until the last 
5 memory address is reached. When the last memory address is reached, the DSP returns to 
the first memory address and continues to sequentially write data into memory. Each DSP 
module typically contains enough memory to store several seconds of data for each block 
of RF channels to support the latency and queuing times in the location process, 

10 In the DSP module, the memory address at which digitized and converted RF data is 

written into memory is the time stamp used throughout the Wireless Location System and 
which the location processing references in determining TDOA. In order to ensure; that the 
time stamps are aligned at every SCS 1 0 in, the Wireless Location System, the address 
generator 10-3-8 receives the one pulse per second signal from the timing generation/clock 

15 distribution module 10-7 (Figure 2). Periodically, the address generator at all SCS's 10 in 
a Wireless Location System will simultaneously reset themselves to a known address, this 
enables the location processing to reduce or eliminate accumulated timing errors in the 
recording of time stamps for each digitized data element. 

20 The address generator 10-3-8 controls both writing to and reading from the dual port 

digital memory 10-3-3. Writing takes places continuously since the ADC is continuously 
sampling and digitizing RF signals and the first DSP (10-3-1 A and 10-3-lB) is 
continuously performing the digital drop receiver function. However, reading occurs in * 
bursts as the Wireless Location System requests data for performing demodulation and 

25 location processing. The Wireless Location System may even perform location processing 
recursively on a single transmission, and therefore requires access to the same data 
multiple times. In order to service the many requirements of the Wireless Location 
System, the address generator allows the dual port digital memory to be read at a rate 
faster than the writing occurs. Typically, reading can be performed eight times faster than 

30 writing. 
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The DSP module 1 0-3 uses the second DSP 10-3-4 to read the data from the digital 
memory 1 0-3-3, and then performs a second digital drop receiver function to extract 
baseband data from the blocks of RF channels (step S5). For example, the second DSP can 
extract any single 30 KHz AMPS or TDMA channel from any block of RF channels that 
5 have been digitized and stored in the memory. Likewise, the second DSP can extract any 
single GSM channel. The second DSP is not required to extract a CDMA channel, since 
the channel bandwidth occupies the full bandwidth of the stored RF data; The combination 
of the first DSP 10-3-1 A, 10-3-1B and the second DSP 10-3-4 allows the DSP module to 
select, store, and recover any single RF channel in a wireless communications system. A 

1 0 DSP module typically will store four blocks of channels. In a dual-mode AMPS/TDMA 
system, a single DSP module can continuously and simultaneously monitor up to 42 
analog reverse control channels, up to 84 digital control channels, and also be tasked to 
monitor and locate any voice channel transmission. A single SCS chassis will typically 
support up to three receiver modules 10-2 (Figure 2), to cover three sectors of two 

1 5 antennas each, and up to nine DSP modules (three DSP modules per receiver permits an 
entire 15 MHz bandwidth to be simultaneously stored into digital memory). Thus, the SCS 
10 is a very modular system than can be easily scaled to match any type of cell site 
configuration and processing load, 

20 The DSP module 10-3 also performs other functions, including automatic detection of 
active channels used in each sector (step S6), demodulation (step S7), and station based 
location processing (step S8). The Wireless Location System maintains an active map of 
the usage of the RF channels in a wireless communications system (step S9), which 
enables the Wireless Location System to manage receiver and processing resources, and to 

25 rapidly initiate processing when a particular transmission of interest has occurred. The 
active map comprises a table maintained within the Wireless Location System that lists for 
each antenna connected to an SGS 10 the primary channels assigned to that SCS 10 and 
the protocols used in those channels. A primary channel is an RF control channel assigned 
to a collocated or nearby base station which the base station uses for communications with 

30 wireless transmitters. For example, in a typical cellular system with sectored cell sites, 
there will be one RF control channel frequency assigned for use in each sector. Those 
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control channel frequencies would typically be assigned as primary channels for a 
collocated SCS 10. 



The same SCS 10 may also be assigned to monitor the RF control channels of other 
5 nearby base stations as primary channels, even if other SCS's 10 also have the same 
primary channels assigned. In this manner, the Wireless Location System implements a 
system demodulation redundancy that ensures that any given wireless transmission has an 
infinitesimal probability of being missed. When this demodulation redundancy feature is 
used, the Wireless Location System will receive, detect, and demodulate the same wireless 

10 transmission two or more times at more than one SCS 10, The Wireless Location System 
includes means to detect when this multiple demodulation has occurred and to trigger 
location processing only once. This function conserves the processing and 
communications resources of the Wireless Location System, and is further described 
below. This ability for a single SCS 10 to detect and demodulate wireless transmissions 

15 occurring at cell sites not collocated with the SCS 10 permits operators of the Wireless 
Location System to deploy more efficient Wireless Location System networks. For 
example, the Wireless Location System may be designed such that the Wireless Location 
System uses much fewer SCS's 10 than the wireless communications system has base 
stations. 

20 

In the Wireless Location System, primary channels are entered and maintained in the table 
using two methods; direct programming and automatic detection. Direct programming 
Comprises entering primary channel data into the table using one of the Wireless Location 
System user interfaces, such as the Network Operations Console 16 (Figure 1), or by 

25 receiving channel assignment data from the Wireless Location System to wireless 
communications system interface. Alternatively, the DSP module 1 0-3 also runs a 
background process known as automatic detection in which the DSP uses spare or 
scheduled processing capacity to detect transmissions on various possible RF channels and 
then attempt to demodulate those transmissions using probable protocols. The DSP 

30 module can then confirm that the primary channels directly programmed are correct, and 
can also quickly detect changes made to channels at base station and send an alert to the 
operator of the Wireless Location System. 
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The DSP module performs the following steps in automatic detection (see Figure 2E-1): 
for each possible control and/or voice channel which may be used in the coverage area 
of the SCS 10, peg counters are established (step S7-1); 
5 at the start of a detection period, all peg counters are reset to zero (step S7-2); 

each time that a transmission occurs in a specified RF channel, and the received power 
level is above a particular pre-set threshold, the peg counter for that channel is 
incremented (step S7-3); 
each time that a transmission occurs in a specified RF channel, and the received power 
10 level is above a second particular pre-set threshold, the DSP module attempts to 

demodulate a certain portion of the transmission using a first preferred protocol (step 
S7-4); 

if the demodulation is successful, a second peg counter for that channel is incremented 
(step S7-5); 

15 if the demodulation is unsuccessful, the DSP module attempts to demodulate a portion 
of the transmission using a second preferred protocol (step S7-6); 
if the demodulation is successful, a third peg counter for that channel is incremented 
(step S7-7); 

at the end of a detection period, the Wireless Location System reads all peg counters 
20 (step S7-8); and 

the Wireless Location System automatically assigns primary channels based upon the 
peg counters (step S7-9). 

The operator of the Wireless Location System can review the peg counters and the 

25 automatic assignment of primary channels and demodulation protocols, and override any 

settings that were performed automatically. In addition, if more than two preferred 

protocols may be used by the wireless carrier, then the DSP module 10-3 can be 

downloaded with software to detect the additional protocols. The architecture of the SCS 

10, based upon wideband receivers 10-2, DSP modules 10-3, and downloadable software 

30 permits the Wireless Location System to support multiple demodulation protocols in a 

single system. There is a significant cost advantage to supporting multiple protocols within 

the single system, as only a single SCS 1 0 is required at a cell site. This is in contrast to 
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many base station architectures, which may require different transceiver modules for 
different modulation protocols. For example, while the SCS 10 could support AMPS, 
TDMA, and CDMA simultaneously in the same SCS 10, there is no base station currently 
available that can support this functionality. 

5 

The ability to detect and demodulate multiple protocols also includes the ability to 
independently detect the use of authentication in messages transmitted over the certain air 
interface protocols. The use of authentication fields in wireless transmitters started to 
become prevalent within the last few years as a means to reduce the occurrence of fraud in 

10 wireless communications systems. However, not all wireless transmitters have 

implemented authentication* When authentication is used, the protocol generally inserts an 
additional field into the transmitted message. Frequently this field is inserted between the 
identity of the wireless transmitter and the dialed digits in the transmitted message. When 
demodulating a wireless transmission, the Wireless Location System determines the 

15 number of fields in the transmitted message, as well as the message type (i.e. registration, 
Origination, page response, etc.). The Wireless Location System demodulates all fields and 
if extra fields appear to be present, giving consideration to the type of message 
transmitted, then the Wireless Location System tests all fields for a trigger condition. For 
example, if the dialed digits "91 1" appear in the proper place in a field, and the field is 

20 located either in its proper place without authentication or its proper place with 

authentication, then the Wireless Location System triggers normally. In this example, the 
digits "91 1" would be required to appear in sequence as "911" or "*911", with no other 
digits before or after either sequence. This functionality reduces or eliminates a false 
trigger caused by the digits "911 " appearing as part of an authentication field, 

25 

The support for multiple demodulation protocols is important for the Wireless Location 
System to successfully operate because location processing must be quickly triggered 
when a wireless caller has dialed "91 1" The Wireless Location System can trigger 
location processing using two methods: the Wireless Location System will independently 
30 demodulate control channel transmissions, and trigger location processing using any 
number of criteria such as dialed digits, or the Wireless Location System may receive 
triggers from an external source such as the carrier's wireless communications system. 
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The present inventors have found that independent demodulation by the SCS 10 results in 

the fastest time to trigger, as measured from the moment that a wireless user presses the 

"SEND" or "TALK" (or similar) button oil a wireless transmitter. 

5 Control and Communications Module 10-5 

The control and communications module 10-5, depicted in Figure 2F, includes data 
buffers 10-5-1, a controller 10-5-2, memory 10-5-3, a CPU 10-5-4 and a Tl/El 
communications chip 10-5-5, The module has many of the characteristics previously 
described in Patent Number 5,608,410. Several enhancements have been added in the 

10 present embodiment. For example, the SCS 10 now includes an automatic remote reset 
capability, even if the CPU on the control and communications module ceases to execute 
its programmed software. This capability can reduce the operating costs of the Wireless 
Location System because technicians are not required to travel to a cell site to reset an 
SCS 1 0 if it fails to operate normally. The automatic remote reset circuit operates by 

15 monitoring the communications interface between the SCS 10 and the TLP 12 for a 

particular sequence of bits, This sequence of bits is a sequence that does not occur during 
normal communications between the SCS 10 and the TLP 12. This sequence, for example, 
may consist of an all ones pattern. The reset circuit operates independently of the CPU so 
that even if the CPU has placed itself in a locked or other non-operating status, the circuit 

20 can still achieve the reset of the SCS 10 and return the CPU to an operating status. 

This module now also has the ability to record and report a wide variety of statistics and 
variables used in monitoring or diagnosing the performance of the SCS 10. For example, 
the SCS 10 can monitor the percent capacity usage of any DSP or other processor in the 

25 SCS 10, as well as the communications interface between the SCS 10 and the TLP 12. 
These values are reported regularly to the AP 14 and the NOC 1 6, and are used to 
determine when additional processing and communications resources are required in the 
system. For example, alarm thresholds may be set in the NOC to indicate to an operator if 
any resource is consistently exceeding a preset threshold. The SCS 10 can also monitor the 

30 number of times that transmissions have been successfully demodulated, as well as the 
number of failures. This is useful in allowing operators to determine whether the signal 
thresholds for demodulation have been set optimally. 
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This module^ as well as the other modules its identity to the TLP 12. 

As described below, many SCS's 10 can be connected to a single TLP 12. Typically, the 
communications between SCS's 10 and TLP's 12 is shared with the communications 
5 between base stations and MSC's. It is frequently difficult to quickly determine exactly 
which SCS's 10 have been assigned to particular circuits. Therefore, the SCS 10 contains 
a hard coded identity, which is recorded at the time of installation. This identity can be 
read and verified by the TLP 12 to positively determine which SCS 10 has been assigned 
by a carrier to each of several different communications circuits. 

10 " { ; 1 . __. ; 

The SCS to TLP communications supports a variety of messages, including; commands 
and responses, software download, status and heartbeat, parameter download, diagnostic, 
spectral data, phase data, primary channel demodulation, and RF data. The 
communications protocol is designed to optimize Wireless Location System operation by 

15 minimizing the protocol overhead and the protocol includes a message priority scheme. 
Each message type is assigned a priority, and the SCS 10 and the TLP 12 will queue 
messages by priority such that a higher priority message is sent before a lower priority 
message is sent. For example, demodulation messages are generally set at a high priority 
because the Wireless Location System must trigger location processing on certain types of 

20 calls (i.e., E9-M) without delay. Although higher priority messages are queued before 
lower priority messages, the protocol generally does not preempt a message that is already 
in transit. That is, a message in the process of being sent across the SCS 10 to TLP 12 
communications interface will be completed fully, but then the next message to be sent 
will be the highest priority message with the earliest time stamp. In order to minimize the 

25 latency of high priority messages, long messages, such as RF data, are sent in segments. 
For example, the RF data for a full 100-millisecond AMPS transmission may be separated 
into 10-millisecond segments. In this manner, a high priority message may be queued in 
between segments of the RF data. 

30 Calibration and Performance Monitoring 

The architecture of the SCS 10 is heavily based upon digital technologies including the 

digital receiver and the digital signal processors. Once RF signals have been digitized, 
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timing, frequency, and phase differences can be carefully controlled in the various 
processes. More importantly, any timing, frequency, and phase differences can be 
perfectly matched between the various receivers and various SCS's 10 used in the 
Wireless Location System. However, prior to the ADC, the RF signals pass through a 
5 number ofRF components, including antennas, cables, low noise amplifiers, filters, 
duplexors, multi-couplers, and RF splitters. Each of these RF components has 
characteristics important to the Wireless Location System, including delay and phase 
versus frequency response. When the RF and analog components are perfectly matched 
between the pairs ofSCS's 10, such as SCS 10A and SCS 10B in Figure 2G, then the 

10 effects of these characteristics are automatically eliminated in the location processing. But 
when the characteristics of the components are not matched, then the location processing 
can inadvertently include instrumental errors resulting from the mismatch. Additionally, 
many of these RF components can experience instability with power, time, temperature, or 
other factors that can add instrumental errors to the determination of location. Therefore, 

1 5 several inventive techniques have been developed to calibrate the RF components in the 
Wireless Location System and to monitor the performance of the Wireless Location 
System on a regular basis. Subsequent to calibration, the Wireless Location System stores 
the values of these delays and phases versus frequency response (i.e. by RF channel 
number) in a table in the Wireless Location System for use in correcting these 

20 instrumental errors. Figures 2G-2J are referred to below in explaining these calibration 
methods. 

External Calibration Method 

Referring to Figure 2G, the timing stability of the Wireless Location System is measured 
25 along baselines, where each baseline is comprised of two SCS's, 10A and 1 0B, and an 
imaginary line (A - B) drawn between them. In a TDOA / FDOA type of Wireless 
Location System, locations of wireless transmitters are calculated by measuring the 
differences in the times that each SCS 1 0 records for the arrival of the signal from a 
wireless transmitter. Thus, it is important that the differences in times measured by SCS's 
30 10 along any baseline are largely attributed to the transmission time of the signal from the 
wireless transmitter and minimally attributed to the variations in the RF and analog 
components of the SCS's 10 themselves. To meet the accuracy goals of the Wireless 
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Location System, the timing stability for any pair of SCS's 10 are maintained at much less 
than 100 nanoseconds RMS (root mean square)* Thus, the components of the Wireless 
Location System will contribute less than 100 feet RMS of instrumentation error in the 
estimation of the location of a wireless transmitter. Some of this error is allocated to the 
5 ambiguity of the signal used to calibrate the system. This ambiguity can be determined 
from the well-known Cramer-Rao lower bound equation. In the case of an AMPS reverse 
control channel, this error is approximately 40 nanoseconds RMS. The remainder of the 
error budget is allocated to the components of the Wireless Location System, primarily the 
RF and analog components in the SCS 10. 

10 

In the external calibration method, the Wireless Location System uses a network of 
calibration transmitters whose signal characteristics match those of the target wireless 
transmitters. These calibration transmitters may be ordinary wireless telephones emitting 
periodic registration signals and/or pager espouse signals. Each usable SCS-to-SCS 

15 baseline is preferably calibrated periodically using a calibration transmitter that has a 
relatively clear and unobstructed path to both SCS's 10 associated with the baseline, the 
calibration signal is processed identically to a signal from a target wireless transmitter. 
Since the TDOA values are known a priori, any errors in the calculations are due to 
systemic errors in the Wireless Location System. These systemic errors can then be 

20 removed in the subsequent location calculations for target transmitters. 

Figure 2G illustrates the external calibration method for minimizing timing errors. As 
shown, a first SCS 1 OA at a point "A" and a second SCS 1 OA at a point "B" have an 
associated baseline A-B, A calibration signal emitted at time To by a calibration 

25 transmitter at point "C" will theoretically reach first SCS 10A at time T 0 + T A c* Tac is a 
measure o f the amount of time required for the calibration signal to travel from the 
antenna on the calibration transmitter to the dual port digital memory in a digital receiver. 
Likewise, the same calibration signal will reach second SCS 1 0B at a theoretical time To + 
Tac Usually, however, the calibration signal will not reach the digital memory and the 

30 digital signal processing components of the respective SCS 's 1 0 at exactly the correct 

times. Rather, there will be errors el and e2 in the amount of time (Tac, Tbc) it takes the 

calibration signal to propagate from the calibration transmitter to the SCS's 10, 
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respectively, such that the exact times of arrival are actually To + Tag + el and To + Tbc + 

e 2. Such errors will be due to some extent to delays in the signal propagation through the 

air, i.e., from the calibration transmitter's antenna to the SCS antennas; however, the 
errors will be due primarily to time varying characteristics in the SCS front end 
5 components. The errors el and e2 cannot be determined per se because the system does 
not know the exact time (T 0 ) at which the calibration signal was transmitted. The system 
can, however, determine the error in the difference in the time of arrival of the calibration 
signal at the respective SCS's 10 of any given pair ofSCS's 10, This TDOA error value is 
defined as the difference between the measured TDOA value and the theoretical TDOA 

10 yalue t 0? where x 0 is the theoretical differences between the theoretical delay values T AC 
and Tbc. Theoretical TDOA values for each pair of SCS's 10 and each calibration 
transmitter are known because the positions of the SCS's 10 and calibration transmitter, 
and the speed at which the calibration signal propagates, are known, the measured TDOA 
baseline (TDOA A -b) can be represented as TDOA A -b = t 0 + e, where e = el - e2. In a 

1 5 similar manner, a calibration signal from a second calibration transmitter at point "D" will 
have associated errors e3 and e4. The ultimate value of e to be subtracted from TDOA 
measurements for a target transmitter will be a function (e.g., weighted average) of the 
6 values derived for one of more calibration transmitters. Therefore, a given TDOA 
measurement (TDOA measU red) for a pair of SCS's 10 at points "X" and T' and a target 

20 wireless transmitter at an unknown location will be corrected as follows: 

TDOAx-Y = TDOA^easurcd - € 

e = kl6l+k2€2+....kNeN, 

25 where kl,k2, etc., are weighting factors and el, e2, etc., are the errors determined by 
subtracting the measured TDOA values from the theoretical values for each calibration 
transmitter. In this example, error value e 1 may the error value associated with the 
calibration transmitter at point "C" in the drawing. The weighting factors are determined 
by the operator of the Wireless Location Sy stem, and input into the configuration tables 

30 for each baseline. The operator will take into consideration the distance from each 

calibration transmitter to the SCS's 10 at points "X" and "Y", the empirically determined 
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line of sight from each calibration transmitter to the SCS's 10 at points "X" and "Y" and 
the contribution that each SCS "X" and "Y" would have made to a location estimate of a 
wireless transmitter that might be located in the vicinity of each calibration transmitter. In 
general, calibration transmitters that are nearer to the SCS's 10 at points "X" and "Y" will 
5 be weighted higher than calibration transmitters that are farther away, and calibration 
transmitters with better line of sight to the SCS's 1 0 at points "X" and "Y" will be 
weighted higher than calibration transmitters with worse line of sight. 

Each error component el, e2, etc., and therefore the resulting error component e, can vary 
10 widely, and wildly, over time because some of the error component is due to multipath 
reflection from the calibration transmitter to each SCS 10. The multipath reflection is very 
much path dependent and therefore will vary from measurement to measurement and from 
path to path. It is not an object of this method to determine the multipath reflection for 
these calibration paths, but rather to determine the portion of the errors that are attributable 
15 to the components of the SCS's 10. Typically, therefore, error values el and e3 will have a 
common component since they relate to the same first SCS 10A. Likewise, error values e2 
and e4 will also have a common component since they relate to the second SCS 10B. It is 
known that while the multipath components can vary wildly, the component errors vary 
slowly and typically vary sinusoidally. Therefore, in the external calibration method, the 
20 error values e are filtered using a weighted, time-based filter that decreases the weight of 
the wildly varying multipath components while preserving the relatively slow changing 
error components attributed to the SCS's 10, One such exemplary filter used in the 
external calibration method is the Kalman filter. 

25 The period between calibration transmissions is varied depending on the error drift rates 
determined for the SCS components* The period of the drift rate should be much longer 
than the period of the calibration interval. The Wireless Location System monitors the 
period of the drift rate to determine continuously the rate of change, and may periodically 
adjust the calibration interval, if needed. Typically, the calibration rate for a Wireless 

30 Location System such as one in accordance with the present invention is between 10 and 
30 minutes. This corresponds well with the typical time period for the registration rate in a 
wireless communications system. If the Wireless Location System were to determine that 
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the calibration interval must be adjusted to a rate faster than the registration rate of the 
wireless communications system, then the AP 14 (Figure 1) would automatically force the 
calibration transmitter to transmit by paging the transmitter at the prescribed interval. Each 
calibration transmitter is individually addressable and therefore the calibration interval 
5 associated with each calibration transmitter can be different. 

Since the calibration transmitters used in the external calibration method are standard 
telephones, the Wireless Location System must have a mechanism to distinguish those 
telephones from the other wireless transmitters that are being located for various 

10 application purposes. The Wireless Location System maintains a list of the identities of the 
calibration transmitters, typically in the TLP 12 and in the AP 14. In a cellular system, the 
identity of the calibration transmitter can be the Mobile Identity Number, or MIN. When 
the calibration transmitter makes a transmission, the transmission is received by each SCS 
1 0 and demodulated by the appropriate SCS 1 0. The Wireless Location System compares 

15 the identity of the transmission withapre-stored tasking list of identities of all calibration 
transmitters. If the Wireless Location System determines that the transmission was a 
calibration transmission, then the Wireless Location System initiates external calibration 
processing. 

20 Internal Calibration Method 

In addition to the external calibration method, it is an object of the present invention to 
calibrate all channels of the wideband digital receiver used in the SCS 10 of a Wireless 
Location System. The external calibration method will typically calibrate only a single * 
channel of the multiple channels used by the wideband digital receiver. This is because the 

25 fixed calibration transmitters will typically scan to the highest-power control channel, 
which will typically be the same control channel each time* The transfer function of a 
wideband digital receiver, along with the other associated components, does not remain 
perfectly constant, however, and will vary with time and temperature. Therefore, even 
though the external calibration method can successfully calibrate a single channel, there is 

30 no assurance that the remaining channels will also be calibrated. 
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The internal calibration method, represented in the flowchart of Figure 2H, is particularly 
suited for calibrating an individual first receiver system (i.e., SCS 10) that is characterized 
by a time- and frequency-varying transfer function, wherein the transfer function defines 
how the amplitude and phase of a received signal will be altered by the receiver system 
5 and the receiver system is utilized in a location system to determine the location of a 
wireless transmitter by, in part, determining a difference in time of arrival of a signal 
transmitted by the wireless transmitter and received by the receiver system to be calibrated 
and another receiver system, and wherein the accuracy of the location estimate is 
dependent, in part, upon the accuracy ofTDOA measurements made by the system. An 
10 example of a AMPS RCC transfer function is depicted in Figure 21, which depicts how the 
phase of the transfer function varies across the 2 1 control channels spanning 630 KHz. 

Referring to Figure 2H, the internal calibration method includes the steps of temporarily 
and electronically disconnecting the antenna used by a receiver system from the receiver 

15 system (step S-20); injecting an internally generated wideband signal with known and 
stable signal characteristics into the first receiver system (step S-21); utilizing the 
generated wideband signal to obtain an estimate ofthe manner in which the transfer 
function varies across the bandwidth of the first receiver system (step S-22); and utilizing 
the estimate to mitigate the effects of the variation ofthe first transfer function on the time 

20 and frequency measurements made by the first receiver system (step S-23). One example 
of a stable wideband signal used for internal calibration is a comb signal, which is 
comprised of multiple individual, equal-amplitude frequency elements at a known spacing, 
such as 5 KHz. An example of such a signal is shown in Figure 2L 

25 The antenna must be temporarily disconnected during the internal calibration process to 
prevent external signals from entering the wideband receiver and to guarantee that the 
receiver is only receiving the stable wideband signal The antenna is electronically 
disconnected only for a few milliseconds to minimize the chance of missing too much of a 
signal from a wireless transmitter. In addition, internal calibration is typically performed 

30 immediately after external calibration to minimize the possibility that the any component 
in the SCS 10 drifts during the interval between external and internal calibration. The 
antenna is disconnected from the wideband receiver using two electronically controlled RF 
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relays (not shown). An RF relay cannot provide perfect isolation between input and output 
even when in the "off" position, but it can provide up to 70 dB of isolation. Two relays 
may be used in series to increase the amount of isolation and to further assure that no 
signal is leaked from the antenna to the wideband receiver during calibration. Similarly, 
5 when the internal calibration function is not being used, the internal calibration signal is 
turned off, and the two RF relays are also turned off to prevent leakage of the internal 
calibration signals into the wideband receiver when the receiver is collecting signals from 
wifeless transmitters. 

10 The external calibration method provides an absolute calibration of a single channel and 
the internal calibration method then calibrates each other channel relative to the channel 
that had been absolutely calibrated. The comb signal is particularly suited as a stable 
wideband signal because it can be easily generated using a stored replica of the signal and 
a digital to analog converter. 

15 

External Calibration Using Wideband Calibration Signal 

The external calibration method described next may be used in connection with an SCS 10 
receiver system characterized by a time- and frequency-varying transfer function, which 
preferably includes the antennas, filters, amplifiers, duplexors, multi-couplers, splitters, 

20 and cabling associated with the SCS receiver system. The method includes the step of 
transmitting a stable, known wideband calibration signal from an external transmitter. The 
wideband calibration signal is then used to estimate the transfer function across a 
prescribed bandwidth of the SCS receiver system. The estimate of the transfer function is 
subsequently employed to mitigate the effects of variation of the transfer function on 

25 subsequent TDOA/FDOA measurements. The external transmission is preferably of short 
duration and low power to avoid interference with the wireless communications system 
hosting the Wireless Location System. 

In the preferred method, the SCS receiver system is synchronized with the external 

30 transmitter. Such synchronization may be performed using GPS timing units. Moreover, 

the receiver system may be programmed to receive and process the entire wideband of the 

calibration signal only at the time that the calibration signal is being sent. The receiver 
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system will riot perform calibration processing at any time other than when in 
synchronization with the external calibration transmissions* In addition, a wireless . 
communications link is used between the receiver system and the external calibration 
transmitter to exchange commands and responses. The external transmitter may use a 
5 directional antenna to direct the wideband signal only at the antennas of the SCS receiver 
system. Such as directional antenna may be a Yagi antenna (i.e. linear end-fire array). The 
calibration method preferably includes making the external transmission only when the 
directional antenna is aimed at the receiver system's antennas and the risk of multipath 
reflection is low. 

10 

Calibrating for Station Biases 

Another aspect of the present invention concerns a calibration method to correct for station 
biases in a SCS receiver system. The "station bias" is defined as the finite delay between 
when an RF signal from a wireless transmitter reaches the antenna arid when that same 

15 signal reached the wideband receiver. The inventive method includes the step of 
measuring the length of the cable from die antennas to the filters and determining the 
corresponding delays associated with the cable length/In addition* the method includes 
injecting a known signal into the filter, duplexor, multi-coupler, of RF splitter and 
measuring the delay and phase response versus frequency response from the input of each 

20 device to the wideband receiver. The delay and phase values are then combined and used 
to correct subsequent location measurements. When used with the GPS based timing 
generation described above, the method preferably includes correcting for the GPS cable 
lengths. Moreover, an externally generated reference signal is preferably used to monitor 
changes in station bias that may arise due to aging and weather. Finally, the station bias by 

25 RF channel and for each receiver system in the Wireless Location System is preferably 
stored in tabular form in the Wireless Location System for use in correcting subsequent 
location processing. 

Performance Monitoring 

30 The Wireless Location System uses methods similar to calibration for performance 

monitoring on a regular and ongoing basis. These methods are depicted in the flowcharts 

of Figure 2K and 2L. Two methods of performance monitoring are used: fixed phones and 
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drive testing of surveyed points. The fixed phone method comprises the following steps 
(see Figure 2K): 

standard wireless transmitters are permanently placed at various points within the 

coverage area of the Wireless Location System (these are then known as the fixed 

phones) (step S-30); 
the points at which the fixed phones have been placed are surveyed so that their 

location is precisely known to within a predetermined distance, for example ten feet 

(stepS-31); 

the surveyed locations are stored in a table in the AP 14 (step S-32); 

the fixed phones are permitted to register on the wireless communications system, at 

the rate and interval set by the wireless communications system for all wireless 

transmitters on the system (step S-33); 
at each registration transmission by a fixed phone, the Wireless Location System 

locates the fixed phone using normal location processing (as with the calibration 

transmitters, the Wireless Location System can identify a transmission as being 

from a fixed phone by storing the identities in a table) (step $-34); 
the Wireless Location System computes an error between the calculated location 

determined by the location processing and the stored location determined by survey 

(step S-35); 

the location, the error value, and other measured parameters are stored along with a 
time stamp in a database in the AP 14 (step S-36); 

the AP 14 monitors the instant error and other measured parameters (collectively 
referred to as an extended location record) and additionally computes various 
statistical values of the error(s) and other measured parameters (step S-37); and 

if any of the error or other values exceed a pre-determined threshold or a historical 
Statistical value, either instantaneously or after performing statistical filtering over a 
prescribed number of location estimates, the AP 14 signals an alarm to the operator 
of the Wireless Location System (step S-38). 

The; extended location record includes a large number of measured parameters usefully for 

analyzing the instant and historical performance of the Wireless Location System. These 

parameters include: the RF channel used by the wireless transmitter, the antenna port(s) 
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used by the Wireless Location System to demodulate the wireless transmission, the 
antenna ports from which the Wireless Location System requested RF data, the peak, 
average, and variance in power of the transmission over the interval used for location 
processing, the SCS 10 and antenna port chosen as the reference for location processing, 
the correlation Value from the cross-spectra correlation between every other SCS 10 and 
antenna used in location processing and the reference SCS 10 and antenna, the delay value 
for each baseline, the multipath mitigation parameters, and the residual values remaining 
after the multipath mitigation calculations* Any of these measured parameters can be 
monitored by the Wireless Location System for the purpose of determining how the 
Wireless Location System is performing. One example of the type of monitoring 
performed by the Wireless Location System may be the variance between the instant value 
of the correlation on a baseline and the historical range of the correlation value. Another 
may be the variance between the instant Value of the received power at a particular 
antenna and the historical range of the received power. Many other statistical values can 
be calculated and this list is not exhaustive. 

The number of fixed phones placed into the coverage area of the Wireless Location 
System can be determined based upon the density of the cell sites, the difficulty of the 
terrain, and the historical ease with which wireless communications systems have 
performed in the area. Typically the ratio is about one fixed phone for every six cell sites, 
however in some areas a ratio of one to one may be required. The fixed phones provide a 
continuous means to monitor the performance of the Wireless Location System, as well as 
the monitor any changes in the frequency plan that the carrier may have made. Many • 
times > changes in the frequency plan will cause a variation in the performance of the 
Wireless Location System and the performance monitoring of the fixed phones provide an 
immediate indication to the Wireless Location System operator. 

Drive testing of surveyed points is very similar to the fixed phone monitoring. Fixed 

phones typically can only be located indoors where access to power is available (i.e. the 

phones must be continuously powered on to be effective). To obtain a more complete 

measurement of the performance of the location performance, drive testing of outdoor test 

points is also performed. Referring to Figure 2L, as with the fixed phones, prescribed test 
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points throughout the coverage area of the Wireless Location System are surveyed to 
within ten feet (step S-40). Each test point is assigned a code, where the code consists of 
either a "*" or a "#", followed by a sequence number (step S-41). For example, "*1001" 
through "* 1 099'* may be a sequence of 99 codes used for test points. These codes should 

5 be sequences, that when dialed, are meaningless to the wireless communications system 
(i.e. the codes do not cause a feature or other translation to occur in the MSG, except for 
an intercept message). The AP 14 stores the code for each test point along with the 
surveyed location (step S-42). Subsequent to these initial steps, any wireless transmitter 
dialing any of the codes will be triggered and located using normal location processing 

10 (steps S-43 and S-44). The Wireless Location System automatically computes an error 
between the calculated location determined by the Ideation processing and the stored 
location determined by survey, and the location and the error value are stored along with a 
time stamp in a database inthe AP 14 (steps S-45 and S-46). The AP 14 monitors the 
instant error, as well as various historical statistical values of the error. If the error values 

15 exceed a predetermined threshold or a historical statistical value, either instantaneously or 
after performing statistical filtering over a prescribed number of location estimates, the AP 
14 signals an alarm to the operator of the Wireless Location System (step S-47). 

TDQA Location Processor (TLP) 

20 The TLP 12, depicted in Figures 1, 1 A and 3, is a centralized digital signal processing 

• ■ > •. 

system that manages many aspects of the Wireless Location System, especially the SCS 's 

10, and provides control over the location processing. Because location processing is DSP 

intensive, one of the major advantages of the TLP 12 is that the DSP resources can be * 

shared among location processing initiated by transmissions at any of the SCS's 10 in a 

25 Wireless Location System. That is, the additional cost of DSP's at the SCS's 10 is reduced 

by having the resource centrally available. As shown in Figure 3, there are three major 

components of the TLP 12: DSP modules 12-1, Tl/El communications modules 12-2 and 

a controller module 12-3. 

30 The Tl/El communications modules 12-2 provide the communications interface to the 

SCS's 10 (Tl and El are standard communications speeds available throughout the 

world). Each SCS 10 communicates to a TLP 12 using one or more DSO's (which are 
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typically 56Kbps or 64 Kbps). Each SCS 10 typically connects to a fractional Tl or El 
circuit, using, e.g., a drop and insert unit or chaitael bank at the cell site. Frequently, this 
circuit is shared with the base station, which communicates with the MSC. At a central 
site, the DSO's assigned to the base station are separated from the DSO's assigned to the 
5 SCS's 10. This is typically accomplished external to the TLP 12 using a digital access and 
control system (D ACS) 13A that not only separates the DSO's but also grooms the DSO's 
from multiple SCS's 10 onto full Tl or El circuits. These circuits then connect from the 
DACS 1 3A to the DACS 1 3B and then to the Tl/El communications module on the TLP 
12, Each Tl/El communications module contains sufficient digital memory to buffer 
10 packets of data to and from each SCS 10 communicating with the module. A single TLP 
chassis may support one or more Tl/El communications modules. 

The DSP modules 12-1 provide a pooled resource for location processing. A single 
module may typically contain two to eight digital signal processors, each of which are 
15 equally available for location processing. Two types of location processing are supported: 
central based and station based, which are described in further detail below. The TLP 
controller 12-3 manages the DSP module(s) 12-1 to obtain optimal throughput. Each DSP 
module contains sufficient digital memory to store all of the data necessary for location 
processing. A DSP is not engaged until all of the data necessary to begin location 
20 processing has been moved from each ofthe involved SCS's 10 to the digital memory on 
the DSP module. Only then is a DSP given the specific task to locate a specific wireless 
transmitter. Using this technique, the DSP's , which are an expensive resource, are never 
kept waiting. A single TLP chassis may support one or more DSP modules. 

The controller module 12-3 provides the real time management of all location processing 

within the Wireless Location System. The AP 14 is the top-level management entity 

within the Wireless Location System, however its database architecture is not sufficiently 

fast to conduct the real time decision making when transmissions occur. The controller 

module 12-3 receives messages from the SCS's 10, including: status, spectral energy in 

various channels for various antennas, demodulated messages, and diagnostics. This 

enables the controller to continuously determine events occurring in the Wireless Location 

System, as well as to send commands to take certain actions. When a controller module 
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receives demodulated messages from SCS's 10, the controller module decides whether 
location processing is required for a particular wireless transmission. The controller 
module 12-3 also determines which SCS's 10 and antennas to use in location processing, 
including whether to use central based or station based location processing. The controller 
module commands SCS's 10 to return the necessary data, and commands the 
communications modules and DSP modules to sequentially perform their necessary roles 
in location processing. These steps are described below in further detail 

The controller module 12-3 maintains a table known as the Signal of Interest Table 
(SOIT). This table contains all of the criteria that may be used to trigger location 
processing on a particular wireless transmission. The criteria may include, for example, 
the Mobile Identity Number, the Mobile Station ID, the Electronic Serial Number, dialed 
digits, System ID, RF channel number, cell site number or sector number, type of 
transmission, and other types of data elements. Some of the trigger events may have 
higher or lower priority levels associated with them for use in detenriining the order of 
processing. Higher priority location triggers will alwiays be processing before lower 
priority location triggers. However, a lower priority trigger that has already begun location 
processing will complete the processing before being assigned to a higher priority task. 
The master Tasking List for the Wireless Location System is maintained on the AP 14, 
and copies of the Tasking List are automatically downloaded to the Signal of Interest 
Table in each TLP 12 in the Wireless Location System. The full Signal of Interest Table is 
downloaded to a TLP 12 when the TLP 12 is reset or first starts. Subsequent to those two 
events, only changes are downloaded from the AP 14 to each TLP 12 to conserve 
communications bandwidth. The TLP 12 to AP 14 communications protocol preferably 
contains sufficient redundancy and error checking to prevent incorrect data from ever 
being entered into the Signal of Interest Table . When the AP 14 and TLP 12 periodically 
have spare processing capacity available, the AP 14 reconfirms entries in the Signal of 
Interest Table to ensure that all Signal oflnterest Table entries in the Wireless Location 
System are in full synchronization. 

Each TLP chassis has a maximum capacity associated with the chassis. For example, a 

single TLP chassis may only have sufficient capacity to support between 48 and 60 SCS's 
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1 0. When a wireless communications system is larger that the capacity of a single TLP 
chassis, multiple TLP chassis are connected together using Ethernet networking. The 
controller module 12-3 is responsible for inter-TLP communications and networking, and 
communicates with the controller modules in other TLP chassis and with Application 
Processors 14 over the Ethernet network. Inter-TLP communications is required when 
location processing requires the use of SCS's 10 that are connected to different TLP 
chassis;. Location processing for each wifeless transmission is assigned to a single DSP 
module in a single TLP chassis. The controller modules 12-3 in TLP chassis select the 
DSP module on which to perform location processing, and then route all of the RF data 
used in location processing to that DSP module. If RF data is required from the SCS's 10 
connected to more that one TLP 1 2, then the controller modules in all necessary TLP 
chassis communicate to move the RF data from all necessary SCS's 10 to their respective 
connected TLP's 12 and then to the DSP module and TLP chassis assigned to the location 
processing. The controller module supports two fully independent Ethernet networks for 
redundancy. A break or failure in any one network causes the affected TLP's 12 to 
immediately shift all communications to the other network. 

the controller modules 12-3 maintain a complete network map of the Wireless Location 
System, including the SCS's 10 associated with each TLP chassis. The network map is a 
table stored in the controller module containing a list of the candidate SCS/antennas that 
may be used in location processing, and various parameters associated with each of the 
SCS/antennas. The structure of an exemplary network map is depicted in Figure 3A. There 
is a separate entry in the table for each antenna connected to an SCS 1 0. When a wireless 
transmission occurs in an area that is covered by SCS's 10 communicating with more than 
one TLP chassis, the controller modules in the involved TLP chassis determine which TLP 
chassis will be the "master" TLP chassis for the purpose of managing location processing, 
Typically, the TLP chassis associated with the SCS 10 that has the primary channel 
assignment for the wireless transmission is assigned to be the master, However, another 
TLP chassis may be assigned instead if that TLP temporarily has no DSP resources 
available for location processing, or if most of the SCS's 1 0 involved in location 
processing are connected to another TLP chassis and the controller modules are 
minimizing inter-TLP communications. This decision making process is fully dynamic, 
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but is assisted by tables in the TLP 12 that pre-deterinine the preferred TLP chassis for 
every primary channel assignment the tables are created by the operator of the Wireless 
Location System, and programmed using the Network Operations Console. 

5 The networking described herein functions for both TLP chassis associated with the same 
wifeless carrier, as well as for chassis that overlap or border the coverage area between 
two wireless carriers. Thus it is possible for a TLP 12 belonging to a first wireless carrier 
to be networked and therefore receive RF data from a TLP 12 (and theSCS's 10 
associated with that TLP 12) belonging to a second wireless carrier. This networking is 

10 particularly valuable in rural areas, where the performance of the Wireless Location 

System can be enhanced by deploying SCS's 10 at cell sites of multiple wireless carriers. 
Since in many cases wireless carriers do not collocate cell sites, t£is feature enables the 
Wireless Location System to access more geographically diverse antennas than might be 
available if the Wireless Location System used only the cell sites from a single wireless 

15 carrier. As described below, the proper selection and use of antennas for location 
processing can enhance the perfb^ 

The controller module 12-3 passes many messages, including location records, to the AP 
14, many of which are described below. Usually, however, demodulated data is not passed 

20 from the TLP 12 to the AP 14. If, however, the TLP 12 receives demodulated data from a 
particular wireless transmitter and the TLP 12 identifies the wireless transmitter as being a 
registered customer of a second wireless carrier in a different coverage area, the TLP 12 
may pass the demodulated data to the first (serving) AP 14A. This will enable the first AP 
14A to communicate with a second AP 14B associated with the second wireless carrier, 

25 and determine whether the particular wireless transmitter has registered for any type of 
location services. If so, the second AP 14B may instruct the first AP 14A to place the 
identity of the particular wireless transmitter into the Signal of Interest Table so that the 
particular wireless transmitter will be located for as long as the particular wireless 
transmitter is in the coverage area of the first Wireless Location System associated with 

30 the first AP 14A. When the first Wireless Location System has detected that tbe particular 

wireless transmitter has not registered in a time period exceeding a pre-determined 

threshold, the first AP 14A may instruct the second AP 14B that the identity of the 
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particular wireless transmitter is being removed from the Signal of Interest Table for the 
. . .. reason of no longer being present in the coverage area associated with the first AP 14A. 

Diagnostic Port 

5 the TLP 12 supports a diagnostic port that is highly useful in the operation and diagnosis 
of problems within the Wireless Location System. This diagnostic port can be accessed 
either locally at a TLP 12 or remotely over the Ethernet network Connecting the TLP's 12 
to the AP's. The diagnostic port enables an operator to write to a file all of the 
demodulation and RF data received from the SCS's 10, as well as the intermediate and 

10 final results of all location processing. This data is erased from the TLP 12 after 

processing a location estimate, and therefore the diagnostic port provides the means to 
save the data for later post-processing and analysis. The inventor's experience in operating 
large scale wireless location systems is that a very small number of location estimates can 
occasionally have very large errors, and these large errors can dominate the overall 

15 operating statistics of the Wireless Location System over any measurement period. 
Therefore, it is important to provide the operator with a set of tools that enable the 
Wireless Location System to detect and trap the cause of the very large errors to diagnose 
and mitigate those errors. The diagnostic port can be set to save the above information for 
all location estimates, for location estimates from particular wireless transmitters or at 

20 particular test points, or for location estimates that meet a certain criteria. For example, for 
fixed phones or drive testing of surveyed points, the diagnostic port can determine the 
error in the location estimate in real time and then write the above described information 
only for those location estimates whose error exceeds a predetermined threshold, The • 
diagnostic port determines the error in real time by storing the surveyed latitude, longitude 

25 coordinate of each fixed phone and drive test point in a table, and then calculating a radial 
error when a location estimate for the corresponding test point is made. 

Redundancy 

The TLP's 12 implement redundancy using several inventive techniques* allowing the 
30 Wireless Location System to support an M plus N redundancy method. M plus N 
redundancy means that N redundant (or standby) TLP chassis are used to provide full 
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redundant backup to M online TLP chassis. For example, M may be ten and N may be 
two, 

First, the controller modules in different TLP chassis continuously exchange status and 
5 "heartbeat" messages at pre-determined time intervals between themselves and with every 
AP 14 assigned to monitor the TLP chassis. Thus, every controller module has continuous 
and full status of every other controller module in the Wireless Location System. The 
controller modules in different TLP chassis periodically select one controller module in 
one TLP 12 to be the master controller for a group of TLP chassis^ The master controller 

10 may decide to place a first TLP chassis into off-line status if the first TLP 12A reports a 
failed or degraded condition in its status message, or if the first TLP 12A fails to report 
any status or heartbeat messages within its assigned and pre-determined time. If the master 
controller places a first TLP 12A into off-line status, the master controller may assign a 
second TLP 12B to perform a redundant switchover and assume the tasks of the off-line 

1 5 first TLP 1 2A. The second TLP 12B is automatically sent the configuration that had been 
loaded into the first TLP 12 A; this configuration may be downloaded from either the 
master controller or from an AP 14 connected to the TLP's 12. The master controller may 
be a controller module on any one of the TLP's 12 that is not in off-line status, however 
there is a preference that the master controller be a controller module in a stand-by TLP 

20 12, When the master controller is the controller module in a stand-by TLP 12, the time 
required to detect a failed first TLP 12 A, place the first TLP 12A into off-line status, and 
then perform a redundant switchover can be accelerated. 

Second, all of the Tl or El communications between the SCS's 10 and each ofthe TLP 

25 Tl/El communications modules 1 2-2 are preferably routed through a high-reliability . 

DACS that is dedicated to redundancy control. The DACS 13B is connected to every 

groomed Tl/El circuit containing DSO's from SCS's 10 and is also connected to every 

Tl/El communications module 12-2 of every TLP 12. Every controller module at every 

TLP 12 contains a map ofthe DACS 13B that describes the DACS' connection list and 

30 port assignments. This DACS 13B is connected to the Ethernet network described above 

and can be controlled by any ofthe controller modules 12-3 at any ofthe TLP's 12. When 

a second TLP 12 is placed into off-line status by a master controller, the master controller 

47 



WO 00/41417 PCT/US99/29462 



sends commands to the DAGS 13B to switch the groomed Tl/El circuit communicating 
with the first TLP 12A to a second TLP 12B which had been in standby status. At the 
same time, the AP 14 downloads the complete configuration file that was being used by 
the second (and now off-line) TLP 12B to the third (and now online) TLP 12C. The time 
5 from the first detection of a failed first TLP chassis to the complete switch-over and 

assumption of processing responsibilities by a third TLP chassis is typically less than few 
seconds. In many cases, no RF data is lost by the SCS's 10 associated with the failed first 
TLP chassis, and location processing can continue without interruption. At the time of a 
TLP fail-over when a first TLP 12A is placed into off-line status, the NOC 1 6 creates an 
10 alert to notify the Wireless Location System operator that the event has occurred. 

Third, each TLP chassis contains redundant power supplies, fans, and other components. 
A TLP chassis can also support multiple DSP modules, so that the failure of a single DSP 
module or even a single DSP on a DSP module reduces the overall amount of processing 

15 resources available but does not cause the failure of the TLP chassis. In all of the cases 
described in this paragraph, the failed component of the TLP 12 can be replaced without 
placing the entire TLP chassis into off-line status. For example, if a single power supply 
fails, the redundant power supply has sufficient capacity to singly support the load of the 
chassis. The failed power supply contains the necessary circuitry to remove itself from the 

20 load of the chassis and not cause further degradation in the chassis. Similarly, a failed DSP 
module can also remove itself from the active portions of the chassis, so as to not cause a 
failure of the backplane or other modules. This enables the remainder of the chassis, 
including the second DSP module, to continue to function normally. Of course, the total 
processing throughput of the chassis is reduced but a total failure is avoided. 

25 

Application Processor (AP) 14 

The AP 14 is a centralized database system, comprising a number of software processes 
that manage the entire Wireless Location System, provide interfaces to external users and 
applications, store location records and configurations, and support various application- 
30 related functionality. The AP 14 uses a commercial hardware platform that is sized to 

match the throughput of the Wireless Location System. The AP 14 also uses a commercial 
relational database system (RDBMS), which has been significantly customized to provide 
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the functionality described herein. While the SCS 1 0 and TLP 1 2 preferably operate 
together on a purely real time basis to determine location and create location records, the 
AP 14 can operate on both a real time basis to store and forward location records and a 
non-real time basis to post-process location records and provide access and reporting over 
time, the ability to store, retrieve, and post-process location records for various types of 
system and application analysis has proven to be a powerful advantage of the present 
invention. The main collection of software processes is known as the ApCore, which is 
shown in Figure 4 and includes the following functions: 

The AP Performance Guardian (ApPerfGuard) is a dedicated software process that is 
responsible for starting, stopping, and monitoring most other ApCore processes as well as 
ApCore communications with the NOC 16. Upon receiving a configuration update 
command from the NOC, ApPerfGuard updates the database and notifies all other 
processes of the change. ApPerfGuard starts and stops appropriate processes when the 
NOC directs the ApCore to enter specific run states, and constantly monitors other 
software processes scheduled to be running to restart them if they have exited or stopping 
and restarting any process that is no longer properly responding. ApPerfGuard is assiped 
to one of the highest processing priorities so that this process cannot be blocked by another 
process that has "run away". ApPerfGuard is also assigned dedicated memory that is not 
accessible by other software processes to prevent any possible corruption from other 
software processes. 

The AP Dispatcher (ApMnDsptch) is a software process that receives location records " 
from the TLP's 12 and forwards the location records to other processes. This process 
contains a separate thread for each physical TLP 12 configured in the system, and each 
thread receives location records from that TLP 12, For system reliability, the ApCore 
maintains a list containing the last location record sequence number received from each 
TLP 12, and sends this sequence number to the TLP 12 upon initial connection. 
Thereafter, the AP 14 and the TLP 12 maintain a protocol whereby the TLP 12 sends each 
location record with a unique identifier. ApMnDsptch forwards location records to 
multiple processes, including Ap91 1, ApDbSend, ApDbRecvLoc, and ApDbFileRecv. 
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The AP Tasking Process (ApDbSend) controls the Tasking List within the Wireless 
Location System. The Tasking List is the master list of all of the trigger criteria that 
determines which wireless transmitters will be located, which applications created the 
criteria, and which applications can receive location record information. The ApDbSend 
5 process contains a separate thread for each TLP 12, over which the ApDbSend 
synchronizes the Tasking List with the Signal of Interest Table on each TLP 12. 
ApDbSend does not send application information to the Signal of Interest Table , only the 
trigger criteria. Thus the TLP 12 does not know why a wireless transmitter must be 
located. The Tasking List allows wireless transmitters to be located based upon Mobile 

10 Identity Number (MIN), Mobile Station Identifier (MSID), Electronic Serial Number 
(ESN) and other identity numbers, dialed sequences of characters and / or digits, home 
System ID (SID), originating cell site and sector, originating RF channel, or message type. 
The Tasking List allows multiple applications to receive location records from the same 
wireless transmitter. Thus, a single location record from a wireless transmitter that has 

15 dialed "91 1" can be sent, for example, to a 91 1 PSAP, a fleet management application, a 
traffic management application, and to ari RF optimization application. 

The Tasking List also contains a variety of flags and field for each trigger criteria, some of 
which are described elsewhere in this specification. One flag, for example, specifies the 

20 maximum time limit before which the Wireless Location System must provide a rough or 
final estimate of the wireless transmitter. Another flag allo ws location processing to be 
disabled for a particular trigger criteria such as the identity of the wireless transmitter. 
Another field contains the authentication required to make changes to the criteria for a 
particular trigger; authentication enables the operator of the Wireless Location System to 

25 specify which applications are authorized to add, delete, or make changes to any trigger 
criteria and associated fields of flags. Another field contains the Location Grade of Service 
associated with the trigger criteria; Grade of Service indicates to the Wireless Location 
System the accuracy level and priority level desired for the location processing associated 
with a particular trigger criteria. For example, some applications may be satisfied with a 

30 rough location estimate (perhaps for a reduced location processing fee), while other 
applications may be satisfied with low priority processing that is riot guaranteed to 
complete for any given transmission (and which may be pre-empted for high priority 
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processing tasks). The Wireless Location System also includes means to support the use of 
wildcards for trigger criteria in die Tasking List. For example, a trigger criteria can be 
entered as "MtN = 215555****". This Will cause the Wireless Location System to trigger 
location processing for any wireless transmitter whose MIN begins with the six digits 
215555 and ends with any following four digits. The wildcard characters can be placed 
into any position in a trigger criteria. This feature can save on the number of memory 
locations required in the Tasking List and Signal of Interest Table by grouping blocks of 
related wireless transmitters together, 

ApDbSend also supports dynamic tasking. For example, the MIN, ESN, MSID, or other 
identity of any wireless transmitter that has dialed "91 1" will automatically be placed onto 
the Tasking List by ApDbSend for one hour. Thus, any further transmissions by the 
wireless transmitter that dialed "91 1 " will also be located in case of further emergency. 
For example, if a PSAP calls back a wireless transmitter that had dialed "91 1" within the 
last hour, the Wireless Location System will trigger on the page response message from 
the wireless transmitter, and can make this new location record available to the PSAP. 
This dynamic tasking can be set for any interval of time after an initiation event, and for 
any type of trigger criteria. The ApDbSend process is also a server for receiving tasking 
requests from other applications. These applications, such as fleet management, can send 
tasking requests via a socket connection, for example. These applications can either place 
or remove trigger criteria. ApDbSend conducts an authentication process with each 
application to verify that that the application has been authorized to place or remove 
trigger criteria, and each application can only change trigger criteria related to that 
application. 

The AP 9 1 1 Process (Ap9 1 1 ) manages each interface between the Wireless Location 

System and E9-1-1 network elements, such as tandem switches, selective routers, ALI 

databases and/or PSAPs. The Ap9 1 1 process contains a separate thread for each 

connection to a E9-1-1 network element, and can support more than one thread to each 

network element. The Ap91 1 process can simultaneously operate hi many modes based 

upon user configuration, and as described herein. The timely processing of E9- 1 - 1 location 

records is one of the highest processing priorities in the AP 14, and therefore the Ap91 1 
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executes entirely out of random access memory (RAM) to avoid the delay associated with 
first storing and then retrieving a location record from any type of disk. When 
ApMnDsptch forwards a location record to Ap91 1, Ap91 1 immediately makes a routing 
determination and forwards the location record over the appropriate interface to a E9-1-1 
network element. A separate process, operating in parallel, records the location record into 
the AP 14 database. 

The AP 14, through the Ap91 1 process and other processes, supports two modes of 
providing location records to applications, including E9-1-1 : "push" and "pull" modes. 
Applications requesting push mode receive a location record as soon as it is available from 
the AP 14. This mode is especially effective for E9-1-1 which has a very time critical need 
for location records, since E9-1-1 networks must route wireless 9-1-1 calls to the correct 
PSAP within a few seconds after a wireless caller has dialed "911" Applications 
requesting pull mode do not automatically receive location records, but rather must send a 
query to the AP 14 regarding a particular wireless transmitter in order to receive the last, 
or any other location record, about the wireless transmitter. The query from the application 
can specify the last location record, a series of location records* or all location records 
meeting a specific time or other criteria, such as type of transmission. An example of the 
Use of pull mode in the case of a "91 1" call is the E9-1-1 network first receiving the voice 
portion of the "91 1 " call and then querying the AP 14 to receive the location record 
associated with that call. 

When the Ap91 1 process is connected to many E9-1-1 networks elements, Ap91 1 must 
determine to which E9-1-1 network element to push the location record (assuming that 
"push" mode has been selected). The AP 14 makes this determination using a dynamic 
routing table. The dynamic routing table is used to divide a geographic region into cells. 
Each cell, or entry, in the dynamic routing table contains the routing instructions for that 
cell. It is well known that one minute of latitude is 6083 feet, which is about 365 feet per 
millidegree. Additionally, one minute of longitude is cosine(latitude) times 6083 feet, 
which for the Philadelphia area is about 4659 feet, or about 280 feet per millidegree. A 
table of size one thousand by one thousand, or one million cells, can contain the routing 

instructions for an area that is about 69 miles by 53 miles, which is larger than the area of 
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Philadelphia in this example, and each cell could contain a geographic area of 365 feet by 
280 feet. The number of bits allocated to each entry in the table must only be enough to 
support the maximum number of routing possibilities. For example, if the total number of 
routing possibilities is sixteen or less, then the memory for the dynamic routing table is 
one million times four bits, or one-half megabyte. Using this scheme, an area the size of 
Pennsylvania could be contained in a table of approximately twenty megabytes or less, 
with ample routing possibilities available. Given the relatively inexpensive cost of 
memory, this inventive dynamic routing table provides the AP 14 with a means to quickly 
push the location records for "911 " calls only to the appropriate E9-1-1 network element. 

The AP 14 allows each entry in dynamic routing to be populated using manual or 
Automated means. Using the automated means, for example, an electronic map application 
can create a polygon definition of the coverage area of a specific E9-1-1 network element, 
such as a PSAP. The polygon definition is then translated into alist of latitude, longitude 
points contained within the polygon. The dynamic routing table cell corresponding to each 
latitude, longitude point is then given the routing instruction for that E9-1-1 network 
element that is responsible for that geographic polygon. 

When the Ap91 1 process receives a "91 1" location record for a specific wireless 
transmitter, Ap91 1 converts the latitude, longitude into the address of a specific cell in the 
dynamic routing table. Ap9 1 1 then queries the cell to determine the routing instructions, 
which may be push or pull mode and the identity of the E9-1-1 network element 
responsible for serving the geographic area in which the "911" call occurred. If push mode 
has been selected, then Ap91 1 automatically pushes the location record to that E9-1-1 
network element. If pull mode has been selected, then Ap91 1 places the location record 
into a circular table of "91 1 " location records and awaits a query. 

The dynamic routing means described above entails the use of a geographically defined 

database that may be applied to other applications in addition to 91 1, arid is therefore 

supported by other processes in addition to Ap91 1 . For example, the AP 1 4 can 

automatically determine the billing zone from which a wireless call was placed for a 

Location Sensitive Billing application. In addition, the AP 14 may automatically send an 
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alert when a particular wireless transmitter has entered or exited a prescribed geographic 
area defined by an application. The use of particular geographic databases, dynamic 
routing actions, any other location triggered actions are defined in the fields and flags 
associated with each trigger criteria. The Wifeless Location System includes means to 
easily manage these geographically defined databases using an electronic map that can 
create polygons encompassing a prescribed geographic area. The Wireless Location 
System extracts from the electronic map a table of latitude, longitude points contained 
with the polygon. Each application can use its own set of polygons* and can define a set of 
actions to be taken when a location record for a triggered wireless transmission is 
contained within each polygon in the set. 

The AP Database Receive Process (ApDbRecvLoc) receives all location records from 
ApMnDsptch via shared memoiy, and places the location records into the AP location 
database. ApDbRecvLoc starts ten threads that each retrieve location records from shared 
memory, validate each record before inserting the records into the database, and then 
inserts the records into the correct location record partition in the database. To preserve 
integrity, location records with any type of error are not written into the location record 
database but are instead placed into an error file that can be reviewed by the Wireless 
Location System operator and then manually entered into the database after error 
resolution. If the location database has failed or has been placed into off-line status, 
location records are written to a flat file where they can be later processed by 
ApDbFileRecv. 

The AP File Receive Process (ApDbFileRecv) reads flat files containing location records 

and inserts the records into the location database. Flat files are a safe mechanism used by 

the AP 14 to completely preserve the integrity of the AP 14 in all cases except a complete 

failure of the hard disk drives. There are several different types of flat files read by 

ApDbFileRecv, including Database Down, Synchronization, Overflow, and Fixed Error. 

Database Down flat files are written by the ApDbRecvLoc process if the location database 

is temporarily inaccessible; this file allows the AP 14 to ensure that location records are 

preserved during the occurrence of this type of problem. Synchronization flat files are 

written by the ApLocSync process (described below) when transferring location records 
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between pairs of redundant AP systems. Overflow flat files are written by ApMnDsptch 
when location records are arriving into the AP 14 at a rate faster than ApDbRecvLoc can 
process and insert the records into the location database. This may occur during very high 
peak rate periods. The overflow files prevent any records from being lost during peak 
5 periods. The Fixed Error flat files contain location records that had errors but have now 
been fixed, and can now be inserted into the location database. 

Because the AP 14 has a critical centralized role in the Wireless Location System, the AP 
14 architecture has been designed to be folly redundant. A redundant AP 14 system 

10 includes fully redundant hardware platforms, fully redundant RDBMS, redundant disk 
drives, and redundant networks to each other, the TLP's 12, the NOC's 16, and external 
applications. The software architecture of the AP 14 has also been designed to support 
fault tolerant redundancy. The following examples illustrate functionality supported by the 
redundant AFs. Each TLP 12 sends location records to both the primary and the 

15 redundant AP 14 when both AP'sareinan online state. Only the primary AP 14 will 
process incoming tasking requests, and only the primary AP 14 will accept configuration 
change requests from the NOC 16. The primary AP 14 then synchronizes the redundant 
AP 14 under careful control. Both the primary and redundant AP's will accept basic 
startup and shutdown commands from the NOC* Both AP 's constantly monitor their own 

20 system parameters and application health and monitor the corresponding parameters for 
the other AP 14, and then decide which AP 14 will be primary and Which will be 
redundant based upon a composite score. This composite score is determined by compiling 
errors reported by various processes to a shared memory area, and monitoring swap space 
and disk space. There are several processes dedicated to supporting redundancy. 

25 

The AP Location Synchronization Process (ApLocSync) runs on each AP 14 and detects 
the need to synchronize location records between AP's, and then creates "sync records" 
that list the location records that need to be transferred from one AP 14 to another AP 14. 
The location records are then transferred between AP's using a socket connection. 
30 ApLocSync compares the location record partitions and the location record sequence 

numbers stored in each location database. Normally, if both the primary and redundant AP 
14 are operating properly, synchronization is not needed because both AP's are receiving 
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location records simultaneously from the TLP's 12. However, if one AP 14 fails or is 
placed in an off-line mode, then synchronization will later be required. ApLocSync is 
notified whenever ApMnDsptch connects to a TLP 12 so it can determine whether 
synchronization is required. 

5 

The AP Tasking Synchronization Process (ApTaskSync) runs on each AP 14 and 
synchronizes the tasking information between the primary AP 14 and the redundant AP 
14. ApTaskSync on the primary AP 14 receives tasking information from ApDbSend, and 
then sends the tasking information to the ApTaskSync process on the redundant AP 14. If 
10 the primary AP 14 were to fail before ApTaskSync had completed replicating tasks* then 
ApTaskSync will perform a complete tasking database synchronization when the failed 
AP 14 is placed back into an online state. 

The AP Configuration Synchronization Process (ApConfigSync) runs on each AP 14 and 
15 synchronizes the configuration information between the primary AP 14 and the redundant 
AP 14. ApConfigSync uses a RDBMS replication facility. The configuration information 
includes all information needed by the SCS's 10, TLP's 12, and AP's 14 for proper 
operation of the Wireless Location System in a wireless carrier's network, 

20 In addition to the core functions described above, the AP 14 also supports a large number 
of processes, functions, and interfaces useful in the operation of the Wireless Location 
System, as well as useful for various applications that desire location information. While 
the processes, functions, and interfaces described herein are in this section pertaining to* 
the AP 14, the implementation of many of these processes, functions, and interfaces 

25 permeates the entire Wireless Location System and therefore their inventive value should 
be not read as being limited only to the AP 14. 

Roaming 

The AP 14 supports "roaming" between wireless location systems located in different 
30 cities or operated by different wireless carriers. If a first wireless transmitter has 

subscribed to an application on a first Wireless Location System, and therefore has an 
entry in the Tasking List in the first AP 14 in the first Wireless Location System, then the 
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first wireless transmitter may also subscribe to roaming. Each AP 14 and TLP 12 in each 
Wireless Location System contains a table in which a list of valid "home" subscriber 
identities is maintained. The list is typically a range, and for example, for current cellular 
telephones, the range can be determined by the NPA/NXX codes (or area code and 
5 exchange) associated with the MiN or MSID of cellular telephones. When a wireless 
transmitter meeting the "home" criteria makes a transmission, a TLP 12 receives 
demodulated data from one or more SCS's 10 and checks the trigger information in the 
Signal of Interest Table. If any trigger criterion is met, the location processing begins on 
that transmission; otherwise, the transmission is not processed by the Wireless Location 
io System. 

When a first wireless transmitter not meeting the "home" criterion makes a transmission in 
a second Wireless Location System, the second TLP 12 in the second Wireless Location 
System checks the Signal of Interest Table for a trigger. One of three actions then occurs: 

15 (i) if the transmission meets an already existing criteria in the Signal of Interest Table , the 
transmitter is located and the location record is forwarded from the second AP 14 in the 
second Wireless Location System to the first AP 14 in the first Wireless Location System; 
(ii) if the first wireless transmitter has a "roamer" entry in the Signal of Interest Table 
indicating that the first wireless transmitter has "registered" in the second Wireless 

20 Location System but has no trigger criteria, then the transmission is not processed by the 
second Wireless Location System and the expiration timestamp is adjusted as described 
below; (iii) if the first wireless transmitter has no "roamer" entry and therefore has not 
"registered", then the demodulated data is passed from the TLP 12 to the second AP 14. 

25 In the third case above, the second AP 1 4 uses the identity of the first wireless transmitter 
to identify the first AP 14 in the first Wireless Location System as the "home" Wireless 
Location System of the first wireless transmitter. The second AP 14 in the second Wireless 
Location System sends a query to the first AP 14 in the first Wifeless Location System to 
determine whether the first wireless transmitter has subscribed to any location application 

30 and therefore has any trigger criteria in the Tasking List of the first AP 14. If a trigger is 

present in the first AP 14, the trigger criteria, along with any associated fields and flags, is 

sent from the first AP 14 to the second AP 14 and entered in the Tasking List and the 
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Signal of Interest Table as a "roamer" entry with trigger criteria. If the first AP 14 
responds to the second AP 14 indicating that the first wireless transmitter has no trigger 
criteria, then the second AP 14 "registers" the first wireless transmitter in the Tasking List 
and the Signal of Interest Table as a "roamer" with no trigger criteria. Thus both current 
and future transmissions from the first wireless transmitter can be positively identified by 
the TLP 12 in the second Wireless Location System as being registered without trigger 
criteria, and the second AP 14 is not required to make additional queries to the first AP 14. 

When the second AP 14 registers the first wireless transmitter with a roamer entry in the 
Tasking List and the Signal of Interest Table with or without trigger criteria, the roamer 
entry is assigned an expiration timestamp. The expiration timestamp is set to the current 
time plus a predetermined first interval. Every time the first wireless transmitter makes a 
transmission, the expiration timestamp of the roamer entry in the Tasking List and the 
Signal of Interest Table is adjusted to the current time of the most recent transmission plus 
the predetermined first interval. If the first wireless transmitter makes no further 
transmissions prior to the expiration timestamp of its roamer entry, then the roamer entry 
is automatically deleted. If, subsequent to the deletion, the first wireless transmitter makes 
another transmission, then the process of registering occurs again. 

The first AP 14 and second AP 14 maintain communications over a wide area network. 
The network may be based upon TCP/IP or upon a protocol similar to the most recent 
version of IS-4L Each AP 14 in communications with other AP*s in other wireless 
location systems maintains a table that provides the identity of each AP 14 and Wireless 
Location System corresponding to each valid range of identities of wireless transmitters. 

Multiple Pass Location Records 

Certain applications may require a very fast estimate of the general location of a wireless 

transmitter, followed by a more accurate estimate of the location that can be sent 

subsequently. This can be valuable, for example, for E9-1-1 systems that handle wireless 

calls and must make a call routing decision very quickly, but can wait a little longer for a 

more exact location to be displayed upon the E9-1-1 call-taker's electronic map terminal. 

The Wireless Location System supports these applications with an inventive multiple pass 

58 



WO 00/41417 PCT/US99/29462 



location processing mode, described later. The AP 14 supports this mode with multiple 
pass location records. For certain entries, the Tasking List in the AP 14 contains a flag 
indicating the maximum time limit before which a particular application must receive a 
rough estimate of location, and a second maximum time limit in which a particular 
5 application must receive a final location estimate. For these certain applications, the AP 14 
includes a flag in the location record indicating the status of the location estimate 
contained in the record, which may, for example, be set to first pass estimate (ie. rough) 
or final pass estimate. The Wireless Location System will generally determine the best 
location estimate within the time limit set by the application, that is the Wireless Location 

10 System will process the most amount of RF data that can be supported in the time limit. 
Given that any particular wireless transmission can trigger a location record for one or 
more applications j the Wireless Location System supports multiple modes simultaneously. 
For example, a wireless transmitter with a particular MlN can dial "91 1 This may trigger 
a two-pass location record for the E9-1-1 application, but a single pass location record for 

15 a fleet management application that is monitoring that particular MIN. this can be 
extended to finy number of applications. 

Multiple Demodulation and Triggers 

In wireless communications systems in urban or dense suburban areas, frequencies or 
20 channels can be re-used several times within relatively close distances. Since the Wireless 
Location System is capable of independently detecting and demodulating wireless 
transmissions without the aid of the wireless communications system, a single wireless 
transmission can frequently be detected and successfully demodulated at multiple SCS's 
10 within the Wireless Location System. This can happen both intentionally and 
25 unintentionally. An unintentional occurrence is caused by a close frequency re-use, such 
that a particular wireless transmission can be received above a predetermined threshold at 
more than one SCS 10, when each SCS 10 believes it is monitoring only transmissions 
that occur only within the cell site collocated with the SCS 10. An intentional occurrence 
is caused by programming more than one SCS 10 to detect and demodulate transmissions 
30 that occur at a particular cell site and on a particular frequency. As described earlier, this is 
generally used with adjacent or nearby SGS's 10 to provide system demodulation 
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redundancy to further increase the probability that any particular wireless transmission is 
successful detected and demodulated. 

Either type of event could potentially lead to multiple triggers within the Wireless 
Location System, causing location processing to be initiated several times for (he same 
transmission. This causes an excess arid inefficient use of processing and communications 
resources. Therefore, the Wireless Location System includes means to detect when the 
same transmission has been detected and demodulated more than once, and to select the 
best demodulating SCS 10 as the starting point for location processing. When the Wireless 
Location System detects and successfully demodulates the same transmission multiple 
times at multiple SCS/antennas, the Wireless Location System uses the following criteria 
to select the one demodulating SCS/antenna to use to continue the process of determining 
whether to trigger and possibly initiate location processing (again* these criteria may be 
weighted in determining the final decision): (i) an SCS/antenna collocated at the cell site 
to which a particular frequency has been assigned is preferred over another SGS/antehna^ 
but this preference may be adjusted if there is rip operating and on-line SCS/antenna * 
collocated at the cell site to which the particular frequency has been assigned, (ii) 
SCS/antennas with higher average SNR are preferred over those with lower average SNR, 
and (iii) SCS/antennas with fewer bit errors in demodulating the transmission are preferred 
over those with higher bit errors. The weighting applied to each of these preferences may 
be adjusted by the operator of the Wireless Location Systerii to suit the particular design of 
each system. 

Interface to Wireless Communications Systerii 

The Wireless Location System contains means to conuriiiriicate over an interface to a 

wireless communications system* such as a mobile switching ceriter (MSC) or mobile 

positioning controller (MPC), This interface may be based, for example, on a standard 

secure protocol such as the most recent version of the IS-41 or TCP/IP protocols. The 

formats, fields, and authentication aspects of these protocols are well known. The Wireless 

Location System supports a variety of command / response and informational iriessages 

over this interface that are designed to aid in the successful detection, demodulation, and 

triggering of wireless transmissions, as well as providing means to pass location records to 
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the wireless communications system. In particular, this interface provides means for the 
Wireless Location System to obtain information about which wireless transmitters have 
been assigned to particular voice channel parameters at particular cell sites; Example 
messages supported by the Wireless Location System over this interface to the wifeless 
5 communications system include the following: 

Query onMIN /MDN / MSID / IMSI / TMSI Mapping -Certain types of wireless 
transmitters will transmit their identity in a familiar form that can be dialed over the 
telephone network. Other types of wireless transmitters transmit an identity that cannot 

10 be dialed, but which is translated into a number that can be dialed using a table inside 
of the wireless communications system. The transmitted identity is permanent in most 
cases, but can also be temporary. Users of location applications Connected to the AP 
14 typically prefer to place triggers onto the Tasking List using identities that can be 
dialed. Identities that can be dialed are typically kndwnas Mobile Directory Numbers 

15 (MDN). The other types of identities for which translation may be required includes 
Mobile Identity Number (MIN), Mobile Subscriber Identity (MSID), International 
Mobile Subscriber Identity (IMSI), and Temporary Mobile Subscriber Identity 
(TMSI). If the wireless cdminunications system has enabled the use of encryption for 
any of the data fields in the messages transmitted by wireless transmitters, the Wireless 

20 Location System may also query for encryption information along with the identity 
information. The Wireless Location System includes means to query the wireless 
communications system for the alternate identities for a trigger identity that has been 
placed onto the Tasking List by a location application, or to query the wireless 
communications system for alternate identities for an identity that has been 

25 demodulated by an SCS 10. Other events can also trigger this type of query. For this 
type of query, typically the Wireless Location System initiates the command, and the 
wireless communications system responds. 

Query / Command Change on Voice RF Channel Assignment - Many wireless 
30 transmissions on voice channels do not contain identity information. Therefore, when 
the Wireless Location System is triggered to perform location processing on a voice 
channel transmission, the Wireless Location System queries the wireless 
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communication system to obtain the current voice channel assignment information for 
the particular transmitter for which the Wireless Location System has been triggered. 
For an AMPS transmission, for example, the Wireless Location System preferably 
requires the cell site, sector, and RF channel number currently in use by the wireless 
5 transmitter. For a TDMA transmission, for example, the Wireless Location System 
preferably requires the cell site, sector, RF channel number, arid timeslot currently in 
use by the wireless transmitter. Other iriforrriation elements that may be needed 
includes long code mask and encryption keys v In general, the Wireless Location 
System will initiate the command, and the wireless communications system will 
10 respond. However, the Wireless Location System will also accept a trigger command 
from the wireless communications system that contains the information detailed 
herein. 

The timing on this command / response message set is very critical since voice channel 

15 handoffs can occur quite frequently in wireless communications systems. That is, the 
Wireless Location System will locate any wireless transmitter that is transmitting on a 
particular channel ~ therefore the Wireless Location System and the wireless 
communications system must jointly be certain that the identity of the wireless 
transmitter and the voice channel assignment information are in perfect 

20 synchronization. The Wireless Location System uses several means to achieve this 
obj ective. The Wireless Location System may, for example, query the voice channel 
assignment information for a particular wireless transmitter, receive the necessary RF 
data, then again query the voice channel assignment information for that same wireless 
transmitter, and then verify that the status of the wireless transmitter did not change 

25 during the time in which the RF data was being collected by the Wireless Location 

System, Location processing is not required to complete before the second query, since 
it is only important to verify that the correct RF data was received. The Wireless 
Location System may also, for example, as part of the first query command the 
wireless communications system to prevent a handoff from occurring for the particular 

30 wireless transmitter during the time period in which the Wireless Location System is 

receiving the RF data. Then, subsequent to collecting the RF data* the Wireless 

Location System will again query the voice channel assignment information for that 
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same wireless transmitter, command the wireless communicatidns system to again 
permit handoffs for said wireless transmitter and then verify that the status of the 
wireless transmitter did not change during the time in which the RF data was being 
collected by the Wireless Location System, 

5 

For various reasons, either thfc Wireless Location Syistem or the wireless 
communications system may prefer that the wireless transmitter be assigned to another 
voice RF channel prior to performing location processing. Therefore, as part of the 
command / response sequence, the wireless communications system may instruct the 
10 Wireless Location System to temporarily suspend location processing until the 

wireless communications system has completed a haridoff sequence with the wireless 
tr^smitter, and the wireless 

Location System that RF data can be received, and the voice RF channel upon which 
the data can be received. Alternately, the Wireless Location System may determine 

15 that the particular voice RF channel which a particular wireless transmitter is currently 
iising is unsuitable for obtaining an acceptable location estimate 1 and request that the 
wireless communications system command the wireless tran^tto to handdff. 
Alternately, the Wireless Location System may request that the wireless 
communications system command the wireless transmitter to handoff to a series of 

20 voice RF channels in sequence in order to perform a series of location estimates, 

whereby the Wireless Location System can imprbve upon the accuracy of the location 
estimate through the scries of handoffs; this method is further described later. 

The Wireless Location System can also use this command / response message set to 
25 query the wireless communications system about the identity of a wireless transmitter 
that had been using a particular voice channel (and timeslot, etc.) at a particular cell 
site at a particular time. This enables the Wireless Location System to first perform 
location processing on transmissions without knowing the identities, and then to later 
determine the identity of the wireless transmitters making the transmissions and 
30 append this information to the location record. This particular inventive feature 
enables the use of automatic sequential location of voice channel transmissions. 
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Receive Triggers - The Wireless Location System can receive triggers from the 
wireless communications system to perform location processing on a voice channel 
transmission without knowing the identity of the wireless transmitter. This message set 
bypasses the Tasking List, and does not use the triggering mechanisms within the 
Wireless Location System. Rather, the wireless communications system alone 
determines which wireless transmissions to locate, and then send a command to the 
Wifeless Location System to collect RF data from a particular voice channel at a 
particular cell site and to perform location processing. The Wireless Location System 
responds with a confirmation containing a timestamp when the RF data was collected. 
The Wireless Location System also responds with an appropriate format location 
record when location processing has completed. Based upon the time of the command 
to Wireless Location System and the response with the RF data collection timestamp, 
the wireless communications system determines whether the wifeless transmitter status 
changed subsequent to the command and whether there is a good probability of 
successful RF data collection. 

Make Transmit - The Wireless Location System can command the wireless 
communications system to force a particular wireless transmitter to make a 
transmission at a particular time, or within a prescribed range of times. The wireless 
communications system responds with a confirmation and a time of time range in 
which to expect the transmission. The types of transmissions that the Wireless 
Location System can force include, for example, audit responses and page responses. 
Using this message set, the Wireless Location System can also command the wireless 
communications system to force the wireless transmitter to transmit using a higher 
power level setting. In many cases, wireless transmitters will attempt to use the lowest 
power level settings when transmitting in order to conserve battery life. In order 
improve the accuracy of the location estimate, the Wireless Location System may 
prefer that the wireless transmitter use a higher power level setting. The wireless 
communications system will respond to the Wireless Location System with a 
confirmation that the higher power level setting will be used and a time or time range 
in which to expect the transmission. 
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Delay Wireless Communications System Response to Mobile Access - Some air 
interface protocols, such as CDMA, use a mechanism in which the wireless transmitter 
initiates transmissions on a channel, such as an Access Channel, for example, at the 
lowest or a very low power level setting, and then enters a sequence of steps in which 
(i) the wireless transmitter makes an access transmission; (ii) tile wireless transmitter 
waits for a response from the wireless communications system; (iii) if no response is 
received by the wireless transmitter from the wireless communications system within a 
predetermined time, the wireless transmitter increases its power level setting by a 
predetermined amount, and then returns to step (i); (iv) if a response is received by the 
wireless transmitter from the wireless communications system within a predetermined 
time, the wireless transmitter then enters a normal message exchange. This mechanism 
is useful to ensure that the wireless transmitter uses only the lowest useful power level 
setting for transmitting and does not further waste energy or battery life. It is possible, 
however, that the lowest power level setting at which the wireless transmitter can 
successfully communicate with the wireless communications system is not sufficient 
to obtain an acceptable location estimate. Therefore, the Wireless Location System can 
command the wireless communications system to delay its response to these 
transmissions by a predetermined time or amount. This delaying action will cause the 
wireless transmitter to repeat the sequence of steps (i) through (iii) one or more times 
than normal with the result that one or more of the access transmissions will be at a 
higher power level than normal The higher power level may preferably enable the 
Wireless Location System to determine a more accurate location estimate. The 
Wireless Location System may command this type of delaying action for either a 
particular wireless transmitter, for a particular type of wireless transmission (for 
example, for all *91 1 ' calls), for wireless transmitters that are at a specified range from 
the base station to which the transmitter is attempting to communicate, or for all 
wireless transmitters in a particular area. 

Send Confirmation to Wireless Transmitter - The Wireless Location System does not 
include means within to notify the wireless transmitter of an action because the 
Wireless Location System cannot transmit; as described earlier the Wireless Location 

System can only receive transmissions. Therefore, if the Wireless Location System 
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desires to send, for example, a confirmation tone upon the completion of a certain 
action, the Wireless Location System commands the wireless communications system 
to transmit a particular message. The message may include* for example, an audible 
confirmation tone, spoken message, or synthesized message to the wireless transmitter, 
5 or a text message sent via a short messaging service or a page. The Wireless Location 
System receives confirmation from the wireless communications system that the 
message has been accepted and sent to the wireless tj^sihittef , This coimhand / 
response message set is important in enabling the Wireless Location System to support 
certain end-user application functions such as Prohibit Location Processing. 

10 

Report Location Records- The Wireless Location System automatically reports 
location records to the wireless communications system for those wireless transmitters 
tasked to report to the wireless communications system, as well as for those 
transmissions that the wireless communications system initiated triggers. The Wireless 
15 Location System also reports on any historical location record queried by the wireless 
communications system and which the wifeless communications system is authorized 
to receive. 

Monitor Internal Wireless Communications System Interfaces, State Table 

20 Iji addition to this above interface between the Wireless Location System and the wireless 

communications system, the Wireless Location System also includes means to monitor 

existing interfaces within the wireless communications system for the purpose of 

intercepting messages important to the Wireless Location System for identifying wireless 

transmitters and the RF channels in use by these transmitters. These interfaces may 

25 include* for example, the ^interface" and "a-bis interface" used in wireless 

comitiunications systems employing the GSM air interface protocol These interfaces are 

weH-known and published in various standards. By monitoring the bi-directional messages 

on these interfaces between base stations (BTS), base station controllers (BSC), and 

mobile switching centers (MSC), and other points, the Wireless Location System can 

30 obtain the same information about the assignment of wireless transmitters to specific 

channels as the wireless communications system itself knows, The Wireless Location 

System includes means to monitor thesfc interfaces at various points. For example, the SCS 
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10 may monitor a BTS to BSC interface. Alternately, a TLP 12 or AP 14 may also monitor 
a BSC where a number of BTS to BSC interfaces have been concentrated. The interfaces 
internal to the wireless communications system are not encrypted and the layered 
protocols are known to those familiar with the art. the advantage to the Wireless Location 
5 System to monitoring these interfaces is that the Wireless Location System may not be 
required to independently detect and demodulate control channel messages from wireless 
transmitters. In addition, the Wireless Location System may obtain all necessary voice 
channel assignment information from these interfaces, 

10 Using these means for a control channel transmission, the SCS 10 receives the 

transmissions as described earlier and records the control channel RF data into memory 
without performing detection and demodulation. Separately, the Wireless Location System 
monitors the messages occurring over prescribed interfaces within the wireless 
communications system, and causes a trigger in the Wireless Location System when the 

15 Wireless Location System discovers a message containing a trigger event. Initiated by the 
trigger event, the Wireless Location System deterra at which 

the wifeless transmission occurred, wd commands a first SCS 10 and a second SCS 10B 
to each search its memory for the start of transmission. This first SCS 10A chosen is an 
SCS that is either collocated with the base station to which the wireless transmitter had 
20 communicated, or an SCS which is adjacent to the base station to which the wireless 
transmitter had communicated. That is, the first SCS 1 OA is an SCS which would have 
been assigned the control channel as a primary channel. If die first SCS 10A successfully 
determines and reports the start of the transmission, then location processing proceeds - 
normally, using the means described below. If the first SCS 10A cannot successfully 
25 determine the start of transmission, then the second SCS 10B reports the start of 
transmission, and then location processing proceeds normally. 

The Wireless Location System also uses these means for voipe channel transmissions. For 

all triggers contained in the Tasking List, the Wireless Location System monitors the 

30 prescribed interfaces for messages pertaining to those triggers. The messages of interest 

include, for example, voice channel assignment messages, handoff messages, frequency 

hopping messages, power up / power down messages, directed re-try messages, 
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termination messages, and other similar action and status messages. The Wireless 
Location System continuously maintains a copy of the state and status of these wireless 
transmitters in a State Table in the AP 14. Each time that the Wireless Location System 
detects a message pertaining to one of the entries in the Tasking List, the Wireless 

5 Location System updates its own State Table. Thereafter, the Wireless Location System 
may trigger to perform location processing, such as on a regular time interval, and access 
the State Table to determine precisely which cell site* sector, RF channel, arid timeslot is 
presently being used by the wireless transmitter. The example contained herein described 
the means by which the Wireless Location System interfaces to a GSM based wifeless . 

10 communications system. The Wireless Location System also supports similar functions 
with systems based upon other air interfaces. 

For certain air interfaces, such as CDMA, the Wireless Location System also keeps certain 
identity information obtained from Access bursts in the control channel in the State Table; 
this information is later used for decoding the masks used for voice channels. For 
example, the CDMA air interface protocol uses the Electronic Serial Number (ESN) of a 
wireless transmitter to, in part, determine the long code mask used in the coding of voice 
channel transmissions. The Wireless Location System maintains this information in the 
State Table for entries in the Tasking List because many wifeless transmitters may 
transmit the information only once; for example, many CDMA mobiles will only transmit 
their ESN during the first Access burst after the wireless transmitter become active ina 
geographic area. This ability to independently determine the long code mask is very useful 
in cases where an interface between the Wireless Location System and the wireless 
communications system is not operative and/or the Wireless Location System is not able 
to monitor one of the interfaces internal to the wireless communications system. The 
opefator of the Wireless Location System may optionally set the Wireless Location 
System to maintain the identity information for all wireless transmitters. In addition to the 
above reasons, the Wireless Location System can provide the voice channel tracking for 
all wireless transmitters that trigger location processing by calling "91 1'\ As described 
earlier, the Wireless Location System uses dynamic tasking to provide location to a 
wireless transmitter for a prescribed time after dialing "911", for example. By maintaining 
the identity information for all wireless transmitters in the State Table, the Wireless 
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Location System is able to provide voice channel tracking for all transmitters in the event 
of a prescribed trigger event * and not just those with prior entries in the Tasking List. 

Applications Interface 
5 Using the AP 14, the Wireless Location System supports a variety of standards based 
interfaces to end-user and carrier location applications using secure protocols such as 
TCP/DP, X.25, SS-7, and IS-41. Each interface between the AP 14 and an external 
application is a secure and authenticated connection that permits the AP 14 to positively 
verify the identity of the application that is connected to the AP 14* This is necessary 

to because each connected application is granted only limited access to location recotds on a 
real-time and/or historical basis. In addition, the AP 14 supports additional command / 
response, real-time, and post-processing functions that are further detailed below. Access 
to these additional functions also requires authentication. The AP 14 maintains a user list 
and the authentication means associated with each user. No application can gain access to 

15 location records or functions for which the application does not have proper authentication 
or access rights. In addition, the AP 14 supports full logging of all actions taken by each 
application in the event that problems arise or a later investigation into actions is required. 
For each command or function in the list below, the AP 14 preferably supports a protocol 
in which each action or the result of each is confirmed, as appropriate. 

20 

Edit Tasking List- This command permits external applications to add, remove, or 
edit entries in the Tasking List* including any fields and flags associated with each 
entry. This command can be supported on a single entry basis, or a batch entry basis 
where a list of entries is included in a single command. The latter is useful, for 

25 example, in a bulk application such as location sensitive billing whereby larger 

volumes of wireless transmitters are being supported by the external application, and it 
is desired to minimize protocol overhead. This command can add or delete 
applications for a particular entry in the Tasking List, however, this command cannot 
delete an entry entirely if the entry also contains other applications not associated with 

30 or authorized by the application issuing the command. 
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Set Location Interval - The Wireless Location System can be set to perform location 
processing at any interval for a particular wireless transmitter* on either control .or 
voice channels. For example, certain applications may require the location of a 
wireless transmitter every few seconds when the transmitter is engaged on a voice 
5 channel When the wireless transmitter make an initial transmission, the Wireless 

Location System initially triggers using a standard entry in the Tasking List. If one of 
the fields or flags in this entry specifies updated location on a set interval, then the 
Wireless Location System creates a dynamic task in the Tasking List that is triggered 
by a timer instead of an identity or other transmitted criteria. Each time the timer 

10 expires, which can range from 1 second to several hours, the Wireless Location 
System will automatically trigger to locate the wirefcss transmitter. The Wireless 
Location System uses its interface to the wireless communications system to query 
status of the wireless transmitter, including voice call parameters as described earlier. 
If the wireless transmitter is engaged on a voice channel, then the Wireless Location 

15 System performs location processing. If the wireless transmitter is not engaged in any 
existing transmissions, the Wireless Location System will command the wireless 
communications system to make the wireless transmitter immediately transmit. When 
the dynamic task is set, the Wireless Location System also sets an expiration time at 
which the dynamic task ceases. 

20 

find-User Addition / Deletion - This command can be executed by an end-user of a 
wireless transmitter to place the identity of the wireless transmitter onto the Tasking 
List with location processing enabled, to remove the identity of the wireless transmitter 
from the Tasking List and therefore eliminate identity as a trigger, or to place the 

25 identity of the wireless transmitter onto the Tasking List with location processing 
disabled. When location processing has been disabled by the end^user, known as 
Prohibit Location Processing then no location processing will be performed for the 
wireless transmitter. The operator of the Wireless Location System can optionally 
select one of several actions by the Wireless Location System in response to a Prohibit 

30 Location Processing command by the end user: (i) the disabling action can override all 

other triggers in the Tasking List, including a trigger due to an emergency call such as 

"91 1", (ii) the disabling action can override any other trigger in the Tasking List, 
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except a trigger due to an emergency call such as "91 1 (iii) the disabling action can 
be overridden by other select triggers in the Tasking List. In the first case, the end-user 
is granted complete control over the privacy of the transmissions by the wireless 
transmitter, as no location processing will be performed on that transmitter for any 

5 reason. In the second case, the end-user may still receive the benefits of location 
during an emergency, but at no other times. In an example of the third case, an 
employer who is the real owner of a particular wireless transmitter can override an 
end-user action by an employee who is using the wireless transmitter as part of the job 
but who may not desire to be located. The Wireless Location System may query the 

10 wireless communications system, as described above, to obtain the mapping of the 
identity contained in the wkeldss transmission to other identities. 

The additions and deletions by the end-user are effected by dialed sequences of 
characters and digits and pressing the "SEND" or equivalent button on the wireless 

15 transmitter. These sequences may be optionally chbsgn and made knoWn by the 

operator of the Wireless Location System. For example, one sequence may be "*55 
SEND" to disable location processing. Other sequences are also possible. When the 
end-user can dialed this prescribed sequence, the wireless transmitter will transmit the 
sequence over one of the prescribed control channels of the wireless communications 

20 system. Since the Wireless Location System independently detects and demodulates all 
reverse control channel transmissions, the Wireless Location System can 
independently interpret the prescribed dialed sequence and make the appropriate 
feature updates to the Tasking List, as described above. When the Wireless Location 
System has completed the update to the Tasking List, the Wireless Location System 

25 commands the wireless communications system to send a confirmation to the end-user. 
As described earlier, this may take the forih of an audible tone, recorded or 
synthesized voice, or a text message. This command is executed over the interface 
between the Wireless Location System and the wireless communications system, 

30 Command Transmit -This command allows external applications to cause the 

Wireless Location System to send a command to the wireless communications system 

to make a particular wireless transmitter, or group of wireless transmitters, transmit 
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This command may contain a flag or field that the wireless transmitter^) should 
transmit immediately or at a prescribed time. This command has the effort of locating 
the wireless transmitters) upon command, since the transmissions Will be detected, 
demodulated, and triggered, causing location processing and the generation of a 
5 location record. This is useful in eliminating or reducing any delay in determining 
location such as waiting for the next registration time period for the wireless 
transmitter or waiting for an independent transmission to occur. 

External Database Query and Update - the Wireless Location System includes means 

10 to access an external database, to query the said external database using the identity of 
the wireless transmitter or other parameters contained in the transmission or the trigger 
criteria, and to merge the data obtained from the external database with the data 
generated by the Wireless Location System to create a new enhanced location record, 
the enhanced location record may then be forwarded to requesting applications. The 

15 external database may contain, for example, data elements such as customer 

information, medical information, subscribed features, application related information, 
customer account information, contact information, or sets of prescribed actions to 
take upon a location trigger event. The Wireless Location System may also cause 
updates to the external database, for example, to increment or decrement a billing 

20 counter associated with the provision of location services, or to update the external 
database with the latest location record associated with the particular wireless 
transmitter. The Wireless Location System contains means to performed the actions 
described herein on more than one external database. The list and sequence of external 
databases to access and the subsequent actions to take are contained in one of the fields 

25 contained in the trigger criteria in the Tasking List 

Random Anonymous Location Processing ~ The Wireless Location System includes 

means to perform large scale random anonymous location processing. This function is 

valuable to certain types of applications that require the gathering of a large volume of 

30 d#a about a population of wireless transmitters without consideration to the specific 

identities of the individual transmitters. Applications of this type include: RF 

Optimization, which enables wireless carriers to measure the performance of the 
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wifeless communications system by simultaneously determining location and other 
parameters of a transmission; Traffic Management, which enables government 
agencies and commercial concerns to monitor the flow of traffic on various highways 
using statistically significant samples of wireless transmitters travelling in vehicles; 
5 and Local Traffic Estimation, which enables commercial enterprises to estimate the 
flow of traffic around a particular area which may help determine the viability of 
particular businesses. 

Applications requesting random anonymous location processing optionally receive 

10 location records from two sources; (i) a copy of location records generated for other 
applications, and (ii) location records which have been triggered randomly by the 
Wireless Location System without regard to any specific criteria. All of the location 
records generated from either source are forwarded with all of the identity and trigger 
criteria information removed from the location records; however, the requesting 

15 application(s) can determine whether the record was generated from the fully random 
process or is a copy front another trigger criteria. The random location records are 
generated by a low priority task within the Wireless Location System that performs 
location processing on randomly selected transmissions whenever processing and 
communications resources are available and would otherwise be unused at a particular 

20 instant in time. The requesting application(s) can specify whether the random location 
processing is performed over the entire coverage area of a Wireless Location System, 
over specific geographic areas such as along prescribed highways, or by the coverage 
areas of specific cell sites. Thus, the requesting application(s) can direct the resources 
of the Wireless Location System to those area of greatest interest to each application. 

25 Depending On the randomness desired by the application(s), the Wireless Location 
System can adjust preferences for randomly selecting certam 
for example, registration messages, origination messages, page response messages, or 
voice channel transmissions. 

30 Anonymous Tracking of a Geographic Group - the Wireless Location System 

includes means to trigger location processing on a repetitive basis for anonymous 

groups of wireless transmitters within a prescribed geographic area. For example, a 
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particular location application may desire to monitor the travel route of a wifeless 
transmitter over a prescribed period of time, but without the Wireless Location System 
disclosing the particular identity of the wireless transmitter. The period of time may be 
many hours* days, or weeks. Using the means, the Wifeless Location System: 
5 randomly selects a wireless transmitter that initiates a transinrislsion in the geographic 
area of interest to the application; performs location processing on the tra^mission of 
interest; irreversibly tfanslates and encrypts the identity of the wireless transmitter into 
anew coded identifier; creates a location record using only die new coded identifier as 
an identifying means; forwards the location record to the requesting location 

10 application^); and creates a dynamic task in the Tasking List for the wireless 

transmitter, where the dynamic task has an associated expiration time. Subsequently, 
whenever the prescribed wireless transmitter initiates transmission, the Wireless 
Location System shall trigger using the dynamic task, perform location processing oil 
the transmission of interest, irreversibly translate and encrypt the identity of the 

15 wifeless transmitter into the new coded identifier using the saine means as prior such 
that the coded identifier is the same, create a location record using the coded identifier, 
arid forward the location record to the requesting location application(s). The means 
described herein can be combined with other functions of the Wireless Location 
System to perform this type of monitoring use either control or voice channel 

20 tfansmissions. Further, the means described herein completely preserve the private 
identity of the wireless transmitter, yet enables another class of applications that can 
monitor the travel patterns of wireless transmitters. This class of applications can be of 
great value in determining the planning and design of new roads, alternate route 
planning, or the construction of commercial and retail space. 

25 

Location Record Grouping, Sorting, and Labeling - The Wireless Location System 
include means to post-process the location records for certain requesting applications 
to group, sort, or label the location records. For each interface supported by the 
Wireless Location System, the Wireless Location System stores a profile of the types 
30 of data for which the application is both authorized and requesting, and the types of 

filters or post-processing actions desired by the application. Many applications, such as 
the examples contained herein, do not require individual location records or the 
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specific identities of individual transmitters. For example, an RF optimization 
application derives more value from a large data set of location records for a particular 
cell site or channel than it can from any individual location record. For another 
example, a traffic monitoring application requires only location records from 
5 transmitters that are on prescribed roads or highways, and additionally requires that 
these records be grouped by section of road or highway and by direction of travel. 
Other applications may request that the Wireless Location System forward location 
records that have been formatted to enhance visual display appeal by, for example, 
adjusting the location estimate of the transmitter so that the {remitter's location 
10 appears oil an electronic map directly on a dravtfn road segment rather than adjacent to 
the road sepient/Therefor^^ the Wireless Location System preferably "snaps" the 
location estimate to the nearest drawn road segment. 

The Wireless Location System can filter and report location records to an application 

15 for wireless transmitters communicating Only on a particular cell site, sector, RF 
channel, or group of RF channels. Before forwarding the record to the requesting 
application, the Wireless Location System first verifies that the appropriate fields in 
the record satisfy the requirements. Records hot matching the requirements are not 
forwarded, and records thatching the requirements are forwarded. Sortie filters are 

20 geographic and must be calculated by the Wireless Location System. For example, the 
Wireless Location System can process a location record to determine the closest road 
segment and direction of travel of the wireless transmitter on the road segment The 
Wireless Location System can then forward only records to the application that are • 
determined to be on a particular road segment, and can further enhance the location 

25 record by adding a field containing the determined road segment. In order to determine 
the closest road segment, the Wireless Location System is provided with a database of 
road segments of interest by the requesting application. This database is stored in a 
table where each road segment is stored with a latitude and longitude coordinate 
defining the end point of each segment. Each road sesgment can be modeled asa 

30 straight or curved line* and can be modeled to support one or two directions of travel 

Then for each location record determined by the Wireless Location System, the 

Wireless Location System compares the latitude and longitude in the location record to 
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each rdad segment stored in the database, and determines the shortest distance from a 
modeled line connecting the end points of the segment to the latitude and longitude of 
the location record. The shortest distance is a calculated imaginary line orthogonal to 
the line connecting the two end points of the stored road segment. When the closest 
5 road segment has been determined, the Wireless Location System can further 

determine the direction of travel on the road segment by comparing the direction of 
travel of the wireless transmitter reported by the location processing to the orientation 
Of the road segment The direction that produces the smallest eiror with respect to the 
orientation of the road segments is then reported by the Wireless Location System. 

Network Operations Console (NOC) 16 

The NOC 16 is a network management system that permits operators of the Wireless 
Location System easy access to the programming parameters of the Wireless Location 
System. For example* in some cities, the Wireless Location System may contain many 

15 hundreds or even thousands of SCS's 10. The NOC is the most effective way to manage a 
large Wireless Location System, using graphical user interface capabilities. The NOC will 
also receive real time alerts if certain functions within the Wireless Location System are 
not operating properly. These real time alerts can be used by the operator to take 
corrective action quickly and prevent a degradation of location service. Experience with 

20 trials of the Wireless Location System show that the ability of the system to maintain good 
location accuracy over time is directly related to the operator's ability to keep the system 
operating within its predetermined parameters, 

Location Processing 

25 The Wireless Location System is capable of performing location processing using two 
different methods known as central based processing and station based processing. Both 
techniques were first disclosed in Patent Number 5,327,144, and are further enhanced in 
this specification. Location processing depends in part on the ability to accurately 
determine certain phase characteristics of the signal as received at multiple antennas and at 

30 multiple SCS's 10, Therefore, it is an object of the Wireless Location System to identity 

and remove sources of phase error that impede the ability of the location processing to 

determine the phase characteristics of the received signal. One source of phase error is 
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inside of the wireless transmitter itself, namely the oscillator (typically a crystal oscillator) 
and the phase lock loops that allow the phtaie to time to specific channels for transmitting 
Lower cost crystal oscillators will generally have higher phase noise. Some air interface 
specifications, such as IS-136 arid IS-95A, have specifications covering the phase noise 
with which a wireless telephone can transmit. Other air interface specifications, such as 
IS-553A, do not closely specify phase noise. It is therefore an object of the present 
invention to automatically reduce arid/or eliminate a wireless transmitter's phase noise as a 
source of phase error in location processing, in part by automatically selecting the use of 
central based processing or station based processing. The automatic selection will also 
consider the efficiency with which the communications link between the SCS 10 and the 
TLP 12 is used, and the availability of DSP resources at each of the SCS 10 arid TLP 12, 

When using central based processing, the TDOA and FDOA determination and the 
multipath processing are performed in the TLP 12 along with the position and speed 
determination. This method is preferred when the wireless transmitter has a phase noise 
that is above a predetermined threshold. In these cases, central ba$ed processing is most 
effective in reducing or eliminating the phase noise of the wireless trarisiriitter as a source 
of phase error because the TDOA estimate is performed using a digital representation of 
the actual RF transmission from two antennas, which maybe at the same SCS 10 or 
different SCS's 10, In this method, those skilled in the art will recognize that the phase 
noise of the transmitter is a common mode noise in the TD0A processing, arid therefore is 
self-canceling in the TDOA determination process. This niethod works best* for example, 
with many very low cost AMPS cellular telephones that have a high phase noise. The 
basic steps in central based processing include the steps recited below and represented in 
the flowchart of Figure 6: 

a wireless transiriitter initiates a transmission on either a control channel or a voice 
channel (step S50); 

the transmission is received at multiple antennas and at multiple SCS's 10 in the 

Wireless Location System (step S51); 
the transmission is converted into a digital format in the receiver connected to each 

SCS/antenna (step S52); 
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the digital data is stored in a memory in the receivers in each SCS 1 0 (step S53); 
the transmission is demodulated (step S54); 

the Wireless Location System determines whether to begin location processing for the 
transmission (step S55); 
5 if triggered, the TLP 12 requests copies of the digital data from the memory in receivers 
at multiple SCS's 10 (step S56); 
digital data is sent from multiple SCS's 10 to a selected TLP 12 (step S57); 
the TLP 1 2 performs TDOA, FDOA, and multipath mitigation on the digital data from 
pairs of antennas (step S58); 
10 the TLP 12 performs position and speed detentiination using the TDOA data, and then 
creates a location record and forwards the location record to the AP 14 (step S59). 

The Wireless Location System uses a variable number of bits to represent the transmission 
when sending digital data from the SCS's 10 to the TLP 12. As discussed earlier, the SGS 

15 receiver digitizes wireless transmissions with a high resolution^ or a high riumb er ofbits 
per digital sample in order to achieve a sufficiettt d^^c ftoge. tWs is especially 
required when using wideband digital receivers, which may be simultanebusly receiving 
signals near to the SGS 10A and far from the SCS 10B, Fo* example, up to 14 bits may be 
required to represent a dynamic range of 84 dB, Location processing does not always 

20 require the high resolution pei* digital sample, however. Frequently, locations of sufficient 
accuracy are achievable by the Wireless Location System using a fewer riumber ofbits per 
digital sample. Therefore, to minimize the implementation cost of the Wireless Location 
System by conserving bandwidth on the communication links between each SCS 10 and 
TLP 12, the Wireless Location System determines the fewest riumber of bits required to 

25 digitally represent a transmission while still maintaining a desired accuracy level. This 
determination is based, for example, on the particular air interface protocol used by the 
wireless transmitter, the SNR of the transmission, the degree to which the transmission has 
been perturbed by fading and/or multipath, and the current state of the processing arid 
communication queues in each SCS 10. The number ofbits sent from the SCS 10 to the 

30 TLP 12 are reduced in two ways: the number ofbits per sample is minimized, and the . 

shortest length, or fewest segments* of the transmission possible is used for location 

processing. The TLP 12 can use this minimal RF data to perform location processing and 
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then compare the result with the desired accuracy level. This comparison is performed on 
the basis of a confidence interval calculation. If the location estimate does not fall within 
the desired accuracy limits, the TLP 12 will recursively request additional data from 
selected SCS's 10. The additional data may include an additional number of bits per 
digital sample and/Or may include more segments of the transmission. This process of 
requesting additional data may continue recursively until the TLP 12 has achieved the 
prescribed location accuracy, 

There are additional details to the basic steps described above. These details are described 
in Prior Patent Numbers 5,327,144 and 5,608,410 m other parts of this specification. One 
enhancement to the processes described in earlier patents is the selection of a single 
reference SCS/antenna that is used for each baseline in the location processing. In prior 
art, baselines were determined using pairs of antenna sites around a ring. In the present 
Wireless Location System, the single reference SCS/antenna used is generally the highest 
SiSlR signal, although Other criteria are also used as described bdow. The use of a high 
SNR reference aids central based location processing when the Otter SCS/antennas used in 
the location processing are very weak, such as at or below the noise floor (i.e, zero or 
negative signal to noise ratio). When station based location processing is used, the 
reference signal is a re-modulated signal, which is intentionally created to have a very high 
signal to noise ratio, further aiding location processing for very weak signals at other 
SCS/antennas. The actual selection of the reference SCS/antenna is described below. 

The Wireless Location System mitigates multipath by first recursively estimating the 
components of multipath received in addition to the direct path component and then 
subtracting these components from the received signal. Thus the Wireless Location 
System models the received signal and compares the model to the actual received signal 
arid attempts to minimize the difference between the two using a weighted least square 
difference. For each transmitted signal x(t) from a wireless transmitter, the received signal 
y(t) at each SCS/antenna is a complex combination of signals: 

y(t) - 2 x (t - T n )an <> (t - Tn) , for all n - 0 to N; 
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where x(t) is the signal as transmitted by the wireless transmitter; 
an and x n are the complex amplitude and delays of the multipath components; 
N is the total number of multipath components in the received signal; and 
ao and To are constants for the most direct path component. 

5 

The operator of the Wireless Location System empirically determines a set of constraints 
for each component of multipath that applies to the specific environment in which each 
Wireless Location System is operating. The purpose of the constraints is to liprit the 
amount of processing time that the Wireless Location System spends Optimizing the 

10 results for each multipath mitigation calculation. For example, the Wireless Location 
System may be set to determine only four components of multipath: the first component 
may be assumed to have a time delay in the range ii A to t^; the second component may 
be assumed to have a time delay in the range i2A to T2b; the third component may be 
assumed to have a time delay in the range T3a to T3b; and similar for the fourth 

15 component; however the fourth component is a single value that effectively represents a 
complex combination of many tens of individual (and somewhat difiuse) multipath 
components whose time delays exceed the range of the third component For, ease of 
processing, the Wireless Location System transforms the prior equation into the frequency 
domain, and then solves for the individual components such that a weighted least squares 

20 difference is minimized. 

When using station based processing, the TDOA and FDOA determination an4 rtmltipath 
mitigation are performed in the SCS's 10, while the position and speed deten^atiOh are 
typically performed in the TLP 12. The main advantage of station based processing, as 

25 described in Patent Number 5,327,144, is reducing the amotmt Of data that is sent on the 
communication link between each SCS 10 and TLP 12. However, there may be other 
advantages as well One new objective of the present invention is increasing the effective 
signal processing gain during the TDOA processing. As pointed out earlier, centr^ based 
processing has the advantage of eliminating or reducing phase error caused by the phase 

30 noise in the wireless transmitter. However, no previous disclosure has addressed how to 
eliminate or reduce the same phase noise error when using station based processing. The 
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present invention reduces the phase error and increases the effective signal processing gain 
using the steps recited below and shown in Figure 6: 

a wireless transmitter initiates a transmission on either a control channel or a voice 
5 channel (step S60); 

the transmission is received at multiple antennas and at multiple SCS's 10 in the 

Wireless Location System (step S61); 
the transmission is converted into a digital format in the receiver connected to each 
Sntenna (step S62); 
10 the digital data is stored in a memory in the SCS 10 (step S63); 
the transmission is demodulated (step S64); 

the Wireless Location System determines whether to begin location processing for the 

transmission (step S65); 
if triggered, a first SCS 10A demodulates the transmission and determines an 
15 appropriate phase correction interval (step S66); 

for each such phase correction interval, the first SCS 10A calculates an appropriate 
phase correction and amplitude correction, and encodes this phase correction 
parameter and amplitude correction parameter along with the demodulated data (step 
:". S67);" . 

20 the demodulated data and phase correction and amplitude correction parameters are sent 
from the first SCS 10A to a TLP 12 (step S68); 
the TLP 12 determines the SCS's 10 and receiving antennas to use in the location 

processing (step S69); 
the TLP 12 sends the demodulated data and phase correction and amplitude correction 
25 parameters to each second SCS 10B that will be used in the location processing (step 
S70); 

the first SCS 10 and each second SCS 10B creates a first re-modulated signal based 
upon the demodulated data arid the phase correction and amplittide cortection 
parameters (step S71); 

30 the first SCS 1 OA and each second SCS 10B performs TDOA, FDOA, and multipath 
mitigation using the digital data stored in memory in each SCS 10 and the first re- 
modulated signal (step S72); 
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the TDOA, FDOA, and multipath mitigation data are sent from the first SCS 1 OA and 

each second SCS 10B to the TLP 12 (step S73); 
the TLP 12 performs position arid speed determination using the TDOA data (step S74); 

arid 

5 the TLP 12 creates a location record, and forwards the location record to the AP 14 (step 
S75), 

The advantages of determining phase correction arid amplitude correction parameters are 
most obvious in the location of CDMA wireless transmitters based upon IS-95A. As is 

10 well known, the reverse transmissions from an IS-95A transmitter are sent using non- 
coherent iriodulatibri. Most CDMA base stations only i^j^M6y^'a~^^6 bit interval 
because of the non-coherent modulation^ For a CDMA Access Chaririel, with a bit rate of 
4800 bits per second, there are 256 chips sent per bit, which permits an integration gain of 
24 dB, Using the technique described above, the TDOA processing in each SCS 10 may 

15 integrate, for example, over a full 160 millisecond burst (196,608 chips) to produce an 
integration gain of 53 dB; This additional processing gain enables the present invention to 
detect arid locate CDMA transmissions usirig riiultiple SCS*s 10* even if Ae b^e sMibris 
collocated with the SCS's 10 cannot detect the same CDMA transmission. 

20 For a particular transmission, if either the phase correction parameters or the amplitude 
correction parameters are calculated to be zero, or are not needed, then these paraineters 
are not serit in order to conserve on the nitaber of bits transiftitted ott the Coirimuriicatioris 
link between each SCS 10 arid TLP 12, In another embodiment of the invention* the 
Wireless Location System may use a fixed phase correction interval for a particular 

25 transmission or for all transmissions of a particular air interface protocol, or for all 

transmissions made by a particular type of wireless transmitter. This may* for example, be 
based upon empirical data gathered over some period of time by the Wireless Location 
System showing a reasonable consistency in the phase noise exhibited by various classes 
of transmitters. In these cases, the SCS 10 may save the processing step of determining the 

30 appropriate phase correction interval. 
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Those skilled in the art will recognize that there are many ways o f measuring the phase 
noise of a wireless transmitter. In one embodiment, a pure, noiseless re-modulated copy of 
the signal received at the first SCS 10A may be digitally generated by DSP's in the SCS, 
then the received signal may be compared against the pure signal over each phase 
5 correction interval and the phase difference may be measured directly. In this 

embodiment* the phase cditectionp^ameter will be calculated as the negative of the phase 
difference over that phase correction interval, the number of bits required to represent the 
phase correction parameter will vary with the magnitude of the phase correction 
parameter, and the number of bits may vary for each phase correction interval. It has been 
10 observed that some transmissions, for example, exhibit greater phase noise early in the 
t^^ission, and less phase noise in the irnddte of and l^e^mtBfe t^Sm$^i6ii. 

Station based processing is most useful for wireless transmitters that have relatively low 
phase noise. Although not necessarily required by their respective air interface standards, 

15 wireless telephones that use the TDMA, CDMA, of GSM protocols Will typically exhibit 
lower phase noise. As the phase noise of a wireless transmitter increases, the length of a 
phase correction interval may decrease arid/or the number of bits required to represent the 
phase correction parameters increases. Station based processing is not effective when the 
number of bits required to represent the demodulated data plus the phase correction and 

20 amplitude parameters exceeds a predetermined proportion of the number ofbits required 
to perform central based processing, It i£ therefore an object of the present invention to 
automatically determine for each transmission for which a location is desired whether to 
process the location using central based processing or station based processing. The steps 
in making this determination are recited below and shown in Figure 7: 

25 

a wireless transmitter initiates a transmission on either a control channel or a voice 

channel (step S80); 
the transmission is received at a first SCS 10A (step S81); 

the transmission is converted into a digital format in the receiver connected to each 
30 antenna (step S82); 

the Wireless Location System determines whether to begin location processing for the 
transmission (step S83); 
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if triggered, a first SCS 10A demodulates the tr^mission and estimated an appropriate 
phase correction interval and the number of bits required to encode the phase 
correction arid amplitude correction parameters (step S84); 

the first SCS 10A then estimates the number of bits required for central based 
processing; 

based upon the number of bits required for each respective method, the SCS 10 or the 
TLP 12 determine whether to use central based processing or station based processing 
to perform the location processing for this transmission (step S85). 

In another embodiment of the invention, the Wireless Location System may always use 
central based processing or station based processing for all transmissions of a particular air 
interface protocol, or for all transmissions made by a particular kind of wireless 
transmitter. This may, for example, be based upon empirical data gathered over some 
period of time by the Wireless Location System showing a reasonable consistency in the 
phase noise exhibited by various classes of transmitters. In these cases, the SCS 10 and/or 
the TLP 12 may be saved the processing step of determining the appropriate processing 
method. 

A further enhancement of the present invention, used for both central based processing 

and station based processing, is the use of threshold criteria for including baselines in the 

final determination of location and velocity of the wireless transmitter- For each baseline, 

the Wireless Location System calculates a number of parameters that include: the 

SCS/antenna port used with the reference SCS/antenna in calculating the baseline, the • 

peak* average, and variance in the power of the transmission as received at the 

$C$/antenna port used in the baseline and oyer the interval used for location processing, 

the correlation value from the cross-spectra correlation between the SCS/antenna used in 

the baseline and the reference SCS/antenna, the delay value for the baseline, the multipath 

mitigation parameters, the residual values remaining after the multipath mitigation 

calculations, the contribution of the SCS/antenna to the weighted GDOP in the final 

location solution, and a measure of the quality of fit of the baseline if included in the final 

location solution. Each baseline is included in the final location solution is each meets or 

exceeds the threshold criteria for each of the parameters described herein. A baseline may 
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be excluded from the location solution if it fails to meet one or more of the threshold 
criteria. Therefore, it is frequently possible that the number of SCS/antennas actually Used 
in the final location solution is less than the total number considered. 

5 Previous Patent Numbers 5,327,144 and 5,608,410 disclosed a method by which the 
location processing minimized the least square difference (LSD) Value of the following 
equation: 

LSD - [QuCDelay^Tn-Delay^Oi:) 2 ^ QnCDelay^Tis-Delay^On)^. . >+ Qxy(Delay_T xyr 
10 Defcy_O xy ) 2 

In the present implementation, this equation has been rearranged to the following form in 
order to make the location processing code more efficient: 

15 LSD - £ (TDOAoi - x,- + T 0 ) 2 Wi 2 ; over ail i-1 to N-l 

where N ~ nuinber of SCS/antennas used in the location processing; 
TDOAoi 555 the TDOA to the i th site from reference site 0; 

tj ~ the theoretical line of sight propagation time from the wireless transmitter to the i tb 
20 site; 

To ^ the theoretical line of sight propagation time from the transmitter to the reference; and 
Wj = the weight, or quality factor, applied to the i th baseline. 

In the present implementation, the Wireless Location System also uses another alternate 
25 form of the equation that can aid in determining location solutions when the reference 
signal is not very strong or when it is likely that a bias would exist in the location solution 
using the prior form of the equation: 

LSD' = 2 (TDOAoi - tO V - b 2 Z wj 2 ; over all i=0 to N-l 

30 

Where N - number of SCS/antennas used in the location processing; 
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TDOAoi = the TDOA to the i* site from reference site 0; 
TDOAoo = is assumed to be zero; 

tj - the theoretical line of sight propagation time from the wireless transmitter to the i th 
site; 

5 b = a bias that is separately calculated for each theoretical point that minimizes LSD ' at 
that theoretical point; and 

Wj = the weight, or quality factor, applied to the I th baseline. 

The LSD' foirt of the equation offera 

10 solutions at the reference site by making w 0 equal to the maximum value of the Other 
weights or basing wo on the relative signal strength at the reference site; Note that if w<> is 
much larger than the other weights, then b is approximately equal to to* In general, the 
weights, or quality factors are based on similar criteria to that discussed above for the 
threshold criteria in including baselines. That is, the results of the criteria calculations are 

15 Used for weights and when the criteria falls below threshold the weight is then set to zero 
and is effectively not included in the determination of the final location solution. 

Antenna Selection Process for Location Processing 

Previous inventions and disclosures, such a$ those lifted above; fo^^ 

20 in which a first, second, or possibly third antenna site, cell site, or Baisfe station are required 
to determine location. Patent number 5,608,410 fiu^er discloses a dynamic Selection 
Subsystem (DSS) that is responsible for detcimining which data frames from which 
antenna site locations will be used to calculate the location of a responsive transmitter In 
the DSS, if data frames are received from more than a threshold number of sites, the DSS 

25 determines which are candidates for retention or exclusion, and then dynamically 
organizes data frames for location processing/The DSS prefers to use mOre than the 
minimum number of antenna sites so that the solution is over-detefmihed. Additionally, 
the DSS assures that all transmissions used in the location processing were received from 
the same transmitter and from the same transmission. 

30 

the preferred embodiments of the prior inventions had several limitations, however. First, 

either only one antenna per antenna site (or cell site) is used, or the data from two or four 
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diversity antennas were first combined at the antenna site (or cell site) prior to 
transmission to the central site. Additionally, all antenna sites that received the 
transmission sent data frames to the central site, even if the DSS later discarded the data 
frames, Thus, some communications bandwidth may have been wasted sending data that 
was not used. 

The present inventors have determined that while a minimum of two or three sites are 
required in order determine location* the actual selection of antennas and SCS's 10 to use 
in location processing can have a significant effect on the results of the location 
processing. In addition, it is advantageous to include the means to use more than one 
antenna at each SCS 10 in the location processing. The reason for using data from multiple 
antennas at a cell site independently in the location processing is that the signal received at 
each antenna is uniquely affected by multipath, fading, and other disturbances. It is well 
known in the field that when two antennas are separated in distance by more than one 
wavelength, then each antenna will receive the signal on an independent path. Therefore, 
there is frequently additional and unique information to be gained about the location of the 
wireless transmitter by using multiple antennas* and the ability of the Wireless Location 
System to mitigate multipath is enhanced accordingly. 

It is therefore an object of the present invention to provide an improved method for using 

the signals received from more than one antenna at an SCS 10 in the location processing. 

It is a further object to provide a method to improve the dynamic process used to select the 

cooperating antennas and SCS's 10 used in the location processing, The first object is 

achieved by providing means within the SCS 10 to select and use any segment of data 

collected from any number of antennas at an SCS in the location processing. As described 

earlier, each antenna at a cell site is connected to a receiver internal to the SCS 10. Each 

receiver converts signals received from the antenna into a digital form, and then stores the 

digitized signals temporarily in a memory in the receiver. The TIP 12 has been provided 

with means to direct any SCS 10 to retrieve segments of data from the temporary memory 

of atty receiver, and to provide the data for use in location processing. The second object is 

achieved by providing means within the Wireless Location System to monitor a large 

number of antennas for reception of the transmission that the Wireless Location System 
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desires to locate, and then selecting a smaller set of antennas for use in location processing 
based upon a predetermined set of parameters. One example of this selection process is 
represented by the flowchart Of Figure 8: 

5 a wireless transmitter initiates a transmission on either a control channel or a voice 
channel (step S90); 

the transmission is received at multiple antennas and at multiple SCS's 10 in the 
. Wireless Location System (step S91); 

the transmission is converted into a digital format in the receiver connected to each 
10 antenna (step S92); 

the digital data is stored in a memory in each SCS 10 (step S93); 

the transmission is demodulated at at least one SCS 1 OA and the channel number on 

which the transmission occurred and the cell site and sector serving the wireless 

transmitter is determined (step S94); 
15 based upon the serving cell site and sector, one SCS lOA is 'd&ignated as the 'primary* 

SCS 1 0 for processing that transmission (step S95); 
the primary SCS 1 OA determines a timestemp associated with the demodulated data 

(step S96); 

the Wireless Location System determines whether to begin location processing for the 
20 transmission (step S97); 

if location processing is triggered, the Wireless Location System determines a candidate 

list of SCS's 10 and antennas to use in the location processing (step S98); 
each candidate SCS/aritenna measures and reports several p^ameters in the channel 
number of the transmission and at the time of the timestamp determined by the 
25 primary SCS 10A (step S99); 

the Wireless Location System orders the candidate SCS/ahtenhas using specified criteria 
and selects a reference SCS/antenna and a processing list of SCS/aixtennas to use in the 
location processing (step SI 00); and 
the Wireless Location System proceeds with location processing as described earlier, 
30 using data from the processing list of SCS/antennas (step S101). 
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Selecting Primary SCS/Antenna 

The process for choosing the 'primary' SCS/antenna is critical, because the candidate list 
of SCS's 10 and antennas 10-1 is detenhined in part based Updri the designation of the 
primary SCS/antenna. When a wireless transmitter makes a transmission on a particular 
5 RF channel, the transmission frequently can propagate many miles before the signal 
attenuates below a level at which it can be demodulated. Therefore* there are frequently 
many SCS/antennas capable of demodulating the signal. This especially occurs is urban 
and suburban areas where the fre^tiehcy re-iise pattern of communications 
systems can be quite dense. For example, because of the high usage fate of wireless and 

10 the dense cell site spacing, the present inventors have tested wireless communications 
systems in which the same RF control channel and digital color code were used on cell 
sites spaced about one mile apart. Because the Wireless Location System is independently 
demodulatting these transmissions, the Wireless Location System frequently can 
demodulate the same tr&ismission at two, three, or more separate SGS/antejmas. The 

15 Wireless Location System detects that the sattie transmission has been demodulated 
multiple times at multiple SCS/antennas when the Wireless Location System receives 
multiple demodulated data frames sent from different $GS/Satefloft^s, : j^h..mth'-a.ffiAber- --. 
of bit errors below a predetermined bit error threshold, and with the demodulated data 
matching within an acceptable limit of bit errors, and all occurring Within a predetermined 

20 interval of time. 



When the Wireless Location System detects demodulated data from multiple 
SCS/antennas, it examines the following parameters to detennine which SCS/antenna shall 
be designated the primaiy SCS: average SNR over the transmission interval used for 

25 location processing, the variance in the SNR over the same interval* correlation of the 
beginning of the received transmission against a pure pre-cursor (i.e, for AMPS, the 
dotting md Barker code), the number of bit errors in the demodulated data, and the 
magnitude and rate of change of the SNR from just before the on-set of the transmission to 
the on-set of the transmission, as well as other similar parameters. The average SNR is 

30 typically determined at each SCS/antenna cither over the entire length of the transmission 

to be used for location processing, or over a shorter interval The average SNR over the 

shorter interval can be determined by performing a correlation with the dotting sequence 
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arid/or Barker code and/or sync word, depending on the particular air interface protocol, 
and over a short range of time before, during, and after the timcstamp reported by Qach 
SCS 10. The time iiange may typidally be +/-200 microseconds centered at the timestamp, 
for example. The Wireless Location System will generally order the SCS/antennas using 
the following criteria, each of which may be weighted (multiplied by an appropriate 
factor) when combining the criteria to determine the final decision: SCS/antennas with a 
lower number of bit errors are preferred to SCS/antennas with a higher number of bit 
errors, average SNR for a given SCS/ariterina must be greater than a predetermined 
threshold to be designated as the primary; SCS/antennas with higher average SNR are 
preferred over those with lower average SNR; SCS/antennas with lower SNR variance are 
preferred to those with higher SNR variance; and SCS/antennas with a faster $NR rate of 
change at the on-set of the transmission are preferred to those With a slower rate of change. 
The weighting applied to each of these criteria may be adjusted by the operator of the 
Wireless Location System to suit the particular design of each system. 

The candidate list of SCS 's 10 and antennas 10-1 are selected using a predetermined set of 

criteria based, for example, upon knowledge of the types of cell sites, types of antennas at 

the cell sites, geometry of the antennas* and a weighting factor that weights certain 

antennas more than other antennas. The weighting factor takes into account knowledge of 

the terrain in which the Wireless Location System is operating, past empirical data on the 

contribution of each antenna has made to good location estimates, and other factors that 

may be specific to each different WLS installation. In one embodiment, for example, the 

Wireless Location System may select the candidate list to include all SCS's 10 tip to a 

maximum number of sites (max_number_of_sites) that are closer than a predefined 

maximum radius from the primary site (max_radius_fromjprimary). For example, in an 

urban or suburban environment, where there may be a large number of cell sites, the 

maxjnumberjDf_sites may be limited to nineteen. Nineteen sites would include the 

primary, the first ring of six sites stirroimding the primary (asisuming a classic hexagonal 

distribution of cell sites), and the next ring of twelve sites surrounding the first ring. This 

is depicted in Figure 9. In another embodiment, in a suburban or rural environment, 

maxjiadiusjrom jdmary may be set to 40 miles to ensure that the widest possible set of 

candidate SCS/antennas is available. The Wireless Location System is provided with 
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means to limit the total number of candidate SCS's 10 to a maximum number 
(max_number_candidates)j although each candidate SCS may be permitted to choose the 
best port from among its available antennas. This limits the maximum time spent by the 
Wireless Location System processing a particular location, Max^number candidates may 
5 be set to thirty-two, for example, which means that in a typical three sector wireless 
communications system with diversity, up to 32*6 = 192 total antennas could be 
considered for location processing for a particular transmission. In order to limit the time 
spent processing a particular location, the Wireless Location System is provided with 
means to limit the number of antennas used in the location processing to 
10 max^number_antennas processed. Max^number_antennas_processed is generally less 
than max^riumber candidates, and is typically set to sixteen, 

While the Wireless Location System is provided with the ability to dynamically determine 
the candidate list of SCS' s 1 0 and antennas based upon the predetermined set of criteria 

15 described above, the Wireless Location System can also store a fixed candidate list in a 
table. Thus, for each cell site and sector in the wireless communications system, the 
Wireless Location System has a separate table that defines the Candidate list of SCS's 10 
and antennas 10-1 to use whenever a wireless transmitter initiates a transmission in that 
cell site and sector. Rather than dynamically choose the candidate SCS/antennas each time 

20 a location request is triggered, the Wireless Location System reads the candidate list 
directly from the table when location processing is initiated. 

In general, a large number of candidate SCS's 10 is chosen to provide the Wireless 
Location System with sufficient opportunity and ability to measure and mitigate multipath. 

25 On any given transmission, any one or more particular antennas at one or more SCS's 10 
may receive signals that have been affected to varying degrees by multipath. Therefore, it 
is advantageous to provide this means within the Wireless Location System to 
dynamically select a set of antennas which may have received less multipath than other 
antennas. The Wireless Location System uses various techniques to mitigate as much 

30 multipath as possible from any received signal; however it is frequently prudent to choose 
a set of antennas that contain the least amount of multipath. 
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Choosing Reference and Cooperating SGS/Aritennas 

In choosing the set of SCS/antennas to use in location processing* the Wireless Location 
System orders the candidate SCS/antennas using several criteria, including for example: 
average SNR over the transmission interval used for location processing, the variance in 
5 the SNR over the same interval* correlation of the beginning ofthe received transmission 
againkt a pure pre-cursor (i.e. for AMPS* the dotting and Barker code) and/or demodulated 
data from the primary SCS/antenna, the time of the on-set of the transmission relative to 
the on-set reported at the SCS/anteraia 'at which the transmission wis demodulated, and 
the magnitude and rate of change ofthe SNR from just before the on-set of the 

10 transmission to the on-set ofthe transmission, as well as other similar parameters. The 
average SNR is typically determined at each SCS, and for each antenna in the candidate 
list either over the entire length of the transmission to be used for location processing, or 
over a shorter interval. The average SNR over the shorter interval can be determined by 
performing a correlation with the dotting sequence and/or Barker code and/or sync word, 

15 depending on the particular air interface protocol, and over a short range of time before, 
during, and after the timestarap reported by the primary SCS 1 0. The time range may 
typically be +/-• 200 microseconds centered at the timestainp, for example. The Wireless 
Location System will generally order the candidate SCS/antennas using the following 
criteria, each of which may be weighted when combining the criteria to determine the final 

20 decision: average SNR for a given SCS/antenna must be greater than a predetermined 
threshold to be used in location processing; SCS/antennas with higher average SNR are 
preferred over those with lower average SNR; SCS/anteiirias with lower SNR variance are 
preferred to those with higher SNR variance; SCS/antennas with an on-set closer to the 
on-set reported by the demodulating SCS/antenna are preferred to those with an on-set 

25 more distant in time; SCS/antenna$ with a faster SNR rate of change are preferred to those 
with a slower rate ofchange; SCS/antennas with lower incremental weighted GDOP are 
preferred over those with higher incremental weighted GDOP, where the weighting is 
based upon estimated path loss from the primary SCS. The weighting applied to each of 
these preferences may be adjusted by the operator ofthe Wireless Location System to suit 

30 the particular design of each system. The number of different SCS's 10 used in the 
location processing is maximized up to a predetermined limit; the dumber of antennas 
used at each SCS 10 in limited to a predetermined limit; and the total number of 
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SCS/antennas used is limited to max w number_antennas_processed. The SCS/antenna with 
the highest ranking using the above described process is designated as the reference 
SCS/antenna for location processing. 

5 Best Port Selection Within an SCS 10 

Frequently, the SCS/antennas in the candidate list or in the list to use in location 
processing will include only one or two aUteniias at a particular SCS 1 0, In these cases, the 
Wireless Location System may permit the SCS 10 to choose the "best port" from all or 
some of the antennas at the particular SCS 10, For example, if the Wifeless Location 

10 System chooses to use only one antenna at a first SCS 10, then the first SCS 10 may select 
the best antenna port from the typical six antefina ports that ^e comiected to that SCS 10> 
or it may choose the best antenna port from among the two antehna ports of just one sector 
of the cell site. The best antenna port is chosen by using the same process and comparing 
the same parameters as described above for choosing the set of SCS/antennas to use in 

15 location processing, except that all of the anteqnas being considered for best port are all in 
the same SCS 10. to comparing anterori^ for best port* the SGS 10 may also optionally 
divide the received signal into se^ehts and then itteas^ in each 

segment of the received signal. Then, the SCS 10 can optionally choose the best antenna 
port with highest SNR either by (i) using the antenna port with the moist segments with the 

20 highest SNR, (ii) averaging the SNR in all segments and using the antenna port with the 
highest average SNR, or (iii) using the antenna port with the highest SNR in any one 
segment. 

Detection and Recovery From Collisions 

25 Because the Wireless Location System will use data from many SCS/antenna ports in 
location processing, there is a chance that the received signal at one or more particular 
SCS/antenna ports contains energy that is co-chattnel ifttelrteri&fxoe - ^6fii$r' wireless 
transmitter (i.e, a partial or full collision between two separate wireless tftosmi 
Occurred). There is also a reasonable probability that the co-channel interference has a 

30 much higher SNR than the signal from the target wireless transmitter, and if not detected 

by the Wireless Location System, the co-channel interference may cause an incorrect 

choice of best antenna port at an SCS 10, reference SCS/antenna, candidate SCS/antenna, 
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or SCS/antenna to be used in location processing. The co-channel interference may also 
cause poor TDOA and FDOA results, leading to a failed or poor location estimate. The 
probability of collision increases with the density of cell sites in the host wireless 
communications system, especially in dense suburban or rural environments where the 
frequencies are re-used often and wireless usage by subscribers is high. 

Therefore^ the Wireless Location System includes means to detect and recover from the 
types of collisions described above. For example, in the process of selecting a best port, 
reference SCS/antenna, or candidate SCS/ahtenna, the Wireless Location System 
determines the average SNR of the received signal and the variance ofthe SNR over the 
interval ofthe transmission; when the Variance ofthe SNR is above a predetermined 
threshold, the Wireless Location System assigns a probability that a collision has occurred. 
If the signal received at an SCS/antenna has increased or decreased its SNR in a single 
step, and by an amount greater than a predetermined threshold* the Wireless Location 
System assigns a probability that a collision has occurred. Further, if the average SNR of 
the signal received at a remote SCS is greater than the average SNR that would be 
predicted by a propagation model, given the cell site at which the wireless transmitter 
initiated its transmission and the known transmit power levels and antenna patterns ofthe 
transmitter and receive antennas, the Wireless Location System assigns a probability that a 
collision has occurred. If the probability that a collision has occurred is above a 
predetermined threshold, then the Wifeless Location System performs the further 
processing described below to verify whether and to what extent a collision may have 
impaired the received signal at an SCS/antenna. The advantage of assigning probabilities 
is to reduce or eliminate extra processing for the majority of transmissions for which 
collisions have not occurred. It should be noted that the threshold levels, assigned 
probabilities, and other details of the collision detection and recovery processes described 
herein are configurable, i,e„ selected based on the particular application, environment, 
system variables, etc., that would affect their selection, 

For received transmissions at an SCS/antenna for which the probability of a collision is 

above the predetermined threshold and before using Rf data from a particular antenna port 

in a reference SCS/antenna determination, best port determination or in location 
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processing, the Wireless Location System prefei^ly verifies that th^ data £rom each 
antenna port is frorti the correct wireless transmitter. This is determined, for example, by 
demodulating segments of the received signal to verify, for example* that the MIN, MSDD, 
or other identifying information is correct or that the dialed digits or other message 
characteristics match those received by the SCS/antenna that initially demodulated the 
transmission. The Wireless Location System may also correlate a short segment of the 
received signal at an antenna port with the signal received at the primary SCS 1 0 to verify 
that the correlation result is above a predetermined threshold. If the Wireless Location 
System detects that the variance in the SNR over the entire length of the transmission is 
above a pre-determined threshold, the Wireless Location System may divide the 
twsmssion into segments arid test each segment as described herein to determine 
whether the energy in that segment is piimariiy from the signal from the wireless 
transmitter for which location processing has been selected or from an interfering 
transmitter. 

The Wireless Location System may choose to use the RF data from a particular 
SCS/antenna in location processing even if the Wireless Location System has detected that 
a partial collision has occurred at that SCS/antenna. In these cases, the SCS 10 uses the 
means described above to identify that portion of the received transmission which 
represents 4 signal from the wireless transmitter for which location processing has been 
selected, and that portion of the received transmission which contains co-channel 
interference. The Wireless Location System may command the SCS 10 to send or use only 
selected segments of the received transmission that do not contain the co-channel 
interference. When determining the TDOA and EDOA for a baseline using only selected 
segments from an SCS/antenna, the Wireless Location System uses only the 
corresponding segments of the transmission as received at the reference SCS/antenna, The 
Wireless Location System may continue to use all segments for baselines in which no 
collisions were detected. In many cases, the Wireless Location System is able to complete 
location processing and achieve an acceptable location error using only a portion of the 
transmission. This inventive ability to select the appropriate subset of the received 
transmission and perforin location processing on a segment by segment basis enables the 
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Wireless Location System to successfully complete location processing in cases that might 
have failed using previous techniques* 

Multiple Pass Location Processing 
5 Certain applications may require a very fast estimate of the general location of a wireless 
transmitter, followed by a morfe iccurate estimate of the location that can be sent 
subsequently- This can be valuable, for example, for E94-1 systems that handle wireless 
calls and must make a call routing decision very quickly, but can wait a little longer for a 
more exact location to be displayed upon the E9-1-1 call-taker's electronic map terminal, 
10 The Wireless Location Systehi supports these applications with an inventive multiple pass 
location processing mode. ; ; ^"""; v --'^"' ' " 

In many cases, location accuracy is enhanced by using longer segments of the 
transmission and increasing the processing gain through longer integration intervals. But 

15 longer segments of the transmission require longer processing peripds in the SCS 10 and 
TLP 12, as well as longer time periods for transmitting the RF dati Scrpss^ ft 
communications interface from the SCS 10 to the TLP 12. Therefore, th£ Wireless 
Location System includes means to identify those transmissions that require a fast but 
rough estimate of the location followed by more complete location processing that 

20 produces a better location estimate. The Signal of Interest Table includes a flag for each 
Signal of Interest that requires a multiple pass location approach. This flag specifies the 
maximum amount of time permitted by the requesting location application for the first 
estimate to be sent, as well as the maximum amount of time permitted hy the requesting 
location application for the final location estimate to be sent the Wireless Location 

25 System performs the rough location estimate by selecting a subset of the transmission for 
which to perform location processing. The Wifeless Location System may choose, for 
example, the segment that was identified at the primary SCS/antenna with the highest 
average SNR. After the rough location estimate has been determineid, using the methods 
described earlier, but with only a subset of the transmission, the TLP 12 forwards the 

30 location estimate to the AP 14, which then forwards the rough estimate to the requesting 

application with a flag indicating that the estimate is only rough. The Wireless Location 

System then performs its standard location processing using all of the aforementioned 
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methods, and forwards this location estimate with a flag indicating the final status of this 
location estimate. The Wireless Location System may perform the rough location estimate 
and the final location estimate sequentially on the same DSPinaTLP 12, or may perform 
the location processing in parallel on different DSP's. Parallel processing may be 
necessary to meet the maximum time requirements of the requesting location applications. 
The Wireless Location System supports different maximum time requirements from 
different location applications for the same wireless transmission. 

Very Short Baseline TDOA 

The Wireless Location System is designed to operate in urban* suburban, and rural areas. 
In rural areas, when there are not sufficient cell sites available from a single wireless 
carrier, the Wireless Location System can be deployed with SCSI's 10 located at the cell 
sites of other wireless carriers or at other types of towers, including AM or ¥M radio 
station, paging, and two-way wireless towers. In these cases, rather than sharing the 
existing antennas of the wireless carrier, the Wireless Location System may require the 
installation of appropriate antennas, filters, and low noise amplifiers to match the 
frequency band of the wireless transmitters of interest to be located- For example, an AM 
radio station tower may require the addition of 800 MHz antennas to locate cellular band 
transmitters. There may be cases, however, where no additional towers of any type are 
available at reasonable cost and the Wireless Location System must be deployed on just a 
few towers of the wireless carrier In these cases* the Wireless Location System supports 
an antenna mode known as very short baseline TDOA. This antenna mode becomes active 
when additional antennas are installed on a single cell site tower, whereby the antennas are 
placed at a distance of less than one wavelength apart. This may require the addition of 
just one antenna per cell site sector such that the Wireless Location System uses one * 
existing receive antenna in a sector and One additional antenna that has been placed next to 
the existing receive antenna. Typically, the two antennas in the sector are oriented such 
that the primary axes, or line of direction, of the main beams are parallel and the spacing 
between the two antenna elements is known with precision. In addition* the two RF paths 
from the antenna elements to the receivers in the SCS 1 O are calibrated. 
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In its normal mode, the Wireless Location System determines the TDOA and FDOA for 
pairs of antenna that are separated by many wavelengths. For a TDOA on a baseline using 
antennas from two difference cell sites, the pairs of antennas are separated by thousands of 
wavelengths. For a TDOA on a baseline using antennas at the same cell site, the pairs of 
5 antennas are separated by tens of wavelengths* In either case, the TDOA determination 
effectively results in a hyperbolic line bisecting the baseline arid passing through the . 
location of the wireless transmitter. When antennas are separated by multiple wavelengths, 
the received signal has taken independent paths from the wireless transmitter to each 
antenna, including experiencing different multipath arid Doppler shifts. However, when 

10 two antennas are closer than one wavelength, the two received signals have taken 

essentially the sairie path and ex^ the same fadmgVriiuto^ Doppler shift. 

Therefore, the TDOA arid FDOA processing of the Wireless Location Systein typically 
produces a Doppler shift of zero (or near-zero) hertz, and a time difference on the order of 
zero to one nanosecond. A time difference that short is equivalent to an unambiguous 

15 phase difference between the signals received at the two antennas on the very short 

baseline. For example, at 834 MHz, the wavelength of an AMPS reverse control channel 
transmission is about LI 8 feet A time difference of 0.1 nanoseconds is equivalent to a 
received phase difference of about 30 degrees. In this case, theTDOA riieasureriient 
produces a hyperbola that is essentially a straight line, still passing through the location of 

20 the wireless traristnitter, and in a direction that is rotated 30 degrees frdtri the direction of 
the parallel lines formed by the two antennas on the very short baseline. When the results 
of this very short baseline TDOA at the single cell site are combined with a TDOA 
measurement on a baseline between two cell sites, the Wireless Location System can * 
determine a location estimate using only two cell sites. 

25 

Bandwidth Monitoring Method For Improving Location Accuracy 
AMPS cellular transmitters presently comprise the large majority of the wireless 
transmitters used in the U.S. and AMPS reverse voice channel transmissions are generally 
FM signals modulated by both voice and a supervisory audio tone (SAT). The voice 
30 modulation is standard FM, arid is directly proportion of the person 

using the wireless transmitter. In a typical conversation, each person speaks less that 35% 
of the time, which means that most of the time the reverse voice channel is not being . 
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modulated due to voice. With or without voice* the reverse channel is continuously 
modulated by SAT, which is used by the wireless communications system to monitor 
Channel status. The SAT modulation rate is only about 6 KHz. The voice channels support 
in-band messages that are used for hand-off control and for other reasons* such as for 
5 establishing a 3-way call, for answering a second incoming call while already on a first 
tall, or for responding to ah 'audit' message from the wireless communications system. 
All of these messages, though carried on the voice channel, have characteristics similar to 
the control channel messages. These messages are transmitted infrequently, and location 
systems have ignored these messages and focused on the more prevalent SAT 
10 transmissions as the signal of interest 

In view of the above-described difficulties presented by the limited bandwidth of the FM 
voice and SAT reverse voice channel signals, an object of the present invention is to 
provide an improved method by which reverse voice chajinel (RVC) signals may be 

15 utilized to locate a \^reless tr^mitter, particularly in an emergency situation. Another 
object of the invention is to provide a location method that ^OwS theiociation system to 
avoid making location estimates using RVC signals in situations in which it is likely that 
the measurement will not meet prescribed accuracy and reliability requirements. This 
saves system resources and improves the location system's overall efficiency. The 

20 improved method is based upon two techniques-Figure 10A is a flowchart of a first 
method in accordance with the present invention for measuring location using reverse 
voice channel signals. The method comprises the following steps; 

(i) It is first assumed that a user with a wireless transmitter wishes to be located, or 
25 wishes to have his location updated or improved upon. This may be the case, for 

example, if the wireless user has dialed "911" and is seeking emergency assistance. 
It is therefore also assumed that the user is coherent and in communication with a 
centrally located dispatcher. 

(ii) When the dispatcher desires a location update for a particular wireless transmitter,. 
30 the dispatcher sends a location update command with the identity of the wireless 

transmitter to the Wireless Location System over an application interface. 
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(iii) The Wireless Location System responds to the dispatcher With a confirmation that 
the Wireless Location System has queried the wireless communications system and 
has obtained the voice channel assignment for the wireless transmitter. 

(iv) The dispatcher instructs the wireless user to dial a 9 or more digit number and then 
5 the "SEND" button. This sequence may be something like "123456789" or 

"91 191 191 1". Two functions happen to the reverse voice channel when the 
wireless user dial a sequence of at least 9 digits and then the "SEND" button. First, 
especially for an AMPS cellular voice channel, the dialing of digits causes the 
sending of dual tone multi-frequency (DTMF) tones over the voice channel The 

io modulation index of DTMF tones is very high and during the sending of each digit 

in the DTMF sequence will typically push the bandwidth of the transmitted signal 
beyond +/- 10 KHz, The second function occurs at the pressing of the "SEND" 
button. Whether or not the wireless user subscribes to 3-way calling of other 
special features^ the wireless transmitter will senda inessage over the voice using a 

15 "blank and burst" mode wheire the temsmitter briefly stops sending the FM voice 

and SAT, and instead sends a bursty message modulated in the same manner as the 
control channel (10 Kbits Manchester), If the wireless user dials less than 9 digits, 
the message will be comprised of approximately 544 bits. If the wireless user dials 
9 or more digits, the message is comprised of approximately 987 bits. 

20 (v) After notification by the dispatcher, the Wireless Location System monitors the 
bandwidth of the transmitted signal in the voice channel. As discussed earlier, 
when only the SAT is being transmitted, and even if voice and SAT are being 
transmitted, there may not be sufficient baindwidth in the transmitted signal to ■ 
calculate a high quality location estimate, therefore, the Wireless Location System 

25 conserves location pii3'cess;iici$- j^puroes : ^d| wait? ipttil tfce ti^S3p$^tted si]B^sai 

exceeds a predetermined bandwidth. This may be, for example, set somewhere in 
the range of 8 KHz to 12 KHz. When the DTMF dialed digits are sent or when the 
bursty message is sent, the bandwidth would typically exceed the predetermined 
bandwidth. In fact, if the wireless transmitter does transmit the DTMF tones during 

30 dialing, the bandwidth would be expected to exceed the predetermined bandwidth 

multiple times. This would provide multiple opportunities to perform a location 

estimate. If the DTMF tones are not sent during dialing, the bursty message is still 

100 



WO 00/41417 



PCT/US99/29462 



sent at the time of pressing "SEND", and the bandwidth would typically exceed the 
predetermined threshold, 
(vi) Only when the transmitted bandwidth of the signal exceeds the predetermined 
bandwidth, the Wireless Location Systern initiates location processing. 

Figure 10B is a flowchart of another method in accordance with the present invention for 
measuring location using reverse voice channel signals. The method comprises the 
following steps: 

(i) It is first assumed that a user with a wireless tr^sim^^ be located, or 
wishes to have their location updated or improved tipoh. This may be the case, for 
example, if the wireless user has dialed "91 1" and is seeking emergency assistance. 
It is assumed that the user may not wish to dial digits or may not be able to dial any 
digits in accordance with the previous method. 

(ii) When the dispatcher desires a location update for a particular wireless transmitter 
user, the dispatcher sends a location update command to the Wireless Location 
System over an application interface with the identity of the wireless transmitter. 

(Hi) The Wireless Location System responds to the dispatcher with a confirmation. 

(iv) The Wireless Location System commands the wireless communications system to 
make the wireless transmitter transmit by sending ah "audit" or similar message to 
the wireless transmitter. The audit message is a mechanism by which the wireless 
communications system can obtain a response from the wireless transmitter 
without requiring an action by the end-user and without causing the wireless 
transmitter to ring or otherwise alert. The receipt of an audit message causes the 
wireless transmitter to respond with an "audit response" message on the voice 
channel. 

(v) After notification by the dispatcher, the Wireless Location System monitors the 

bandwidth of the transmitted signal in the voice channel. As discussed earlier, • 

when only the SAT is being transmitted, and even if voice and SAT are being 

transmitted, there may not be sufficient bandwidth in the transmitted signal to 

calculate a high quality location estimate. Therefore, the radio location conserves 

location processing resources and waits until the transmitted signal exceeds a 
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predetermined bandwidth. This may be, for example, set somewhere in the range 
of 8 KHz to 12 KHz. When the audit response message is sent, the bandwidth 
would typically exceed the predetermined bandwidth, 
(vi) Only when the transmitted bandwidth of the signal exceeds the predetermined 
5 bandwidth, the Wireless Location System initiates location processing. 

Estimate Combination Method For improving Location Accuracy 

The accuracy of the location estimate provided by the Wireless Location System may be 

improved by combining multiple statistically-independent location estimates made While 

10 the wireless transmitter is maintaining its position. Even when a wifeless transmitted is 
perfectly stationary, the physical atfdRF environment atbuhd a wireless transmitter is 
constantly changing. For example, vehicles may change their position or another wireless 
tran$mitter which had caused a collision during one location estimate may have stopped 
transmitting or changed its position so as to no longer collide during subsequent ideation 

15 estimates. The location estimate provided by the Wireless Location System will therefore 
change for each transmission, even if consecutive transmissions are made within a very 
short period of time, and each location estimate is statistically independent of the other 
estimates, particularly with respect to the errors caused by the changing environment 

20 When several consecutive statistically independent location estimates are made for a 
wireless transmitter that has not changed its position, the location estimates will tend to 
cluster about the true position. The Wireless Location System combines the location 
estimates using a weighted average or other similar mathematical construct to determine 
the improved estimate. The use of a weighted average is aided by the assignment of a 

25 quality factor to each independent location estimate. This quality factor may be based 
upon, for example, the correlation values, confidence interval, or other similar 
measurements derived from the location processing for each independent estimate. The 
Wireless Location System optionally uses several methods to obtain multiple independent 
transmissions from the wireless transmitter, including (i) using its interface to the wireless 

30 communications system for the Make Transmit command; (ii) using multiple consecutive 
bursts from a time slot based air interface protocol, such as TDMA or GSM; or (iii) 
dividing a voice channel transmission into multiple segments over a period of time and 
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performing location processing independently for each segment. As the Wireless Location 
System increases the number of independent location estimates being combined into the 
filial location estimate* it monitors a Statistic indicating the quality of the cluster. If the 
statistic is below a prescribed threshold value, then the Wireless Location System assumes 
5 that the wireless transmitter is maintaining its position. If the statistic rises above the 
prescribed threshold value, the Wireless Location System assume that the wireless 
transmitter is not maintaining its position and therefore ceases to perform additional 
location estimates. The statistic indicating the quality of the cluster may be, for example, a 
standard deviation calculation or a root mean square (RMS) calculation for the individual 
10 location estimates being combined together and with respect to the dynamically calculated 
combined location estimate. When reporting a location record to a requesting application, 
the Wireless Location System indicates, using a field in the location record, the number of 
independent location estimate combined together to produce the reported location 
estimate, 

15 

Another exemplary process for obtaining and combining multiple location estimates will 
now be explained with reference to Figures 1 1 A-l ID, Figures 1 I A, 1 IB and 1 1 C 
schematically depict the well-known "origination", "page response," and "audit" sequences 
of a wireless communications system^ As shown in Figure 1 1 A, the origination sequence 

20 (initiated by the wireless phone to make a call) may require two transmissions from the 
wireless transmitter, an "originate" signal and an "order confirmation" signal. The order 
confirmation signal is sent in response to a voice channel assignment from the wireless 
communications system (e.g., MSG). Similarly* as shown in Figure l lB, a page sequence 
may involve two transmissions from the wireless transmitter, Tiie page sequence is 

25 initiated by the wireless communications system, e.g., when the wireless transinitter is 
called by another phone. After being paged, the wireless transmitter transmits a page 
response; and then, after being assigned a voice channel, the wireless transmitter transmits 
an order confirmation signal. The audit process, in contrast, elicits a single reverse 
transmission, an audit response signal. An audit and audit response sequence has the 

30 benefit of not ringing the wireless transmitter which is responding. 
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The manner in which these sequences may be used to locate a phone with improved 
accuracy will now be explained. According to the present invention, for example, a stolen 
phone, or a phone with a stolen serial number, is repeatedly pinged with an audit signal, 
which forces it to respond with Multiple audit responses, thus permitting the phone to be 
5 located with greater accuracy. To use the audit sequence, however, the Wireless Location 
System sends the appropriate commands using its interface to the wireless 
coiiutiunications system, which sends the audit message to the wifeless transmitter. The 
Wifeless Location System can also force a call termination (hang up) and then call the 
wireless transmitter back using the standard AM code. The call can be terminated either 

10 by verbally instructing the mobile user to disconnect the call, by discohnecting the call at 
the lahdline end of the call, or by sending ah artificial 6viBr«the^air disciohnect message to 
the base station. This over-the-air disconnect message simulates the pressing of the "END" 
button on a mobile unit. The call-back invokes the above-described paging sequence and 
forces the phone to initiate two frafcsmissions that can be utilized to make location 

15 estimates. 

Referring now to Figure 11 D, the inventive high accuracy location method will now be 
summarized^ First, an initial location estimate is made. Next, the above-described audit or 
"hang up and call back" process is employed to elicit a responisivb ti^mi^sion from the 

20 mobile unit, and then a second location estimate is made. Whether the audit or "hang up 
and call back" process is used will depend on whether the wireless communications 
system and wireless transmitter have both implemented the audit functionality. Steps 
second and third steps are repeated \o obtain however many independent location 
estimates are deemed to be necessary or desirable, and ultimately the multiple statistically- 

25 independent location estimates are combined in an average, weighted average, or similar 
mathematical construct to obtain an improved estimate. The use of a -Weighted average is 
aided by the assignment of a quality factor to each independent location estimate. This 
quality factor may be based upon a correlation percentage, confidence interval, or other 
similar measurements derived from the location calculation process. 
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Bandwidth Synthesis Method For Im location Accuracy 

The Wireless Location System is further capable of improving the accuracy of location 
estimates for wireless transmitters whose bandwidth is relatively narrow using a technique 
of artificial bandwidth synthesis. This technique can applied, for example, to those 
transmitters that use the AMPS, NAMPS, TDMA, and GSM air interface protocols and for 
which there ore a large number df individual RF channels available for use by the wireless 
transmitter. For exemplary purposes, the following description shall refer to AMPS- 
specific details; however, the description can be easily altered to apply to other protocols. 
This method relies on the principle that each wireless tiansmitter is operative to transmit 
only narrowband signals at frequencies spanning a predefine wide bmd of frcquehcies 
that is wider than the bandwidth of tile individual narrowband signals transmitted by the 
wireless transmitter. This method also relies on the aforementioned interface between the 
Wireless Location System arid the wireless communications system over which the WLS 
can command the wireless communications system to make a wireless transmitter handofF 
or switch to another frequency or RF channel By issuing a series of cottiniands, the 
Wireless Location System can force the wireless transmitter to switch sequentially arid in a 
controlled manner to a series of RF channels, allowing the WLS effectively to synthesize a 
wider band received signal from the series of narrowband transmitted signals for the 
purpose of location processing. 

In a presently preferred embodiment of the invention, the bandwidth synthesis means 
includes means for determining a wideband phase versus frequency characteristic of the 
transmissions from the wireless transmitter. For example, the narrowband signals typically 
have a bandwidth of approximately 20 KHz and the predefined wide band of frequencies 
spans approximately 12.5 MHz, which in this example, is the spectrum allocated to each 
cellular carrier by the FCC. With bandwidth synthesis, the resolution of the TDOA 
measurements can be increased to about 1/12.5 MHz; i.e., the available time resolution is 
the reciprocal of the effective bandwidth. 

A wireless transmitter, a calibration transmitter (if used)* SCS's lOA, 10B arid 10C, arid a 

TLP 12 are shown in Figure 12 A. The location of the calibration tirari^ all three 

SCS's are accurately known a priori. Signals, represented by dashed arrows in Figure 
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12 A, are transmitted by the wireless transmitter and calibration transmitter, and received at 
SCS's 10A, 10B and IOC, and processed using techniques previously described. During 
the location processing, RF data from one SCS (e.g. 10B) is cross-correlated (in the time 
or frequency domain) with the data stream from another SCS (e.g. IOC) separately for 
each transmitter arid for eachpair of SCS's 10 to generate TDOA estimates TDOA23 and 
TDOA13. An intermediate output of the location processing is a set of coefficients 
representing the complex cross-power as a function of frequency (e g., R 23 ). 

For example, ifX(f) is the Fourier transform of the signal x(t) received at a first site and 
Y(0 is the Fourier transform of the signal y(t) received at ^ second site, then the complex 
cross^powerR(f)^X(f)Y ,|E (f) J where V* is the complex conjugate oiY. The phase angle of 
R(f) at any frequency f equals the phase ofX(f) minus the phase ofY(f). The phase angle 
of R(f) may be called the fringe phase. In the absence of noise, interference, and other 
errors, the fringe phase is a perfectly linear function of frequency within a (contiguous) 
frequency band observed; and slope of the line is minus the iiiterferbmetiic group delay, or 
TDOA; the intercept of the line at the band center frequency, equal to the average value of 
the phase ofR(f), is called "the" fringe phase of the observation when reference is being 
made to the whole band. Within a band, the fringe phase may be considered to be a 
function of frequency. 

The coefficients obtained for the calibration transmitter are combined with those obtained 

for the wireless transmitter and the combinations are analyzed to obtain calibrated TDOA 

measurements TDOA23 andTDOAu, respectively. In the calibration process* the fringe 

phase of the calibration transmitter is subtracted from the fringe phase of the wireless 

transmitter in order to cancel systematic errors that are common to both. Since each 

original fringe phase is itself the difference between the phases of signals received at two 

SCS 's 10, the calibration process is often called double-differencing and the calibrated 

result is said to be doubly-differenced, TDOA estimate T-ij is & ffi**xiiW^ 

estimate of the time difference of arrival (TDOA), between sitbs i aiid j , of the signal 

transmitted by the wireless transmitter, calibrated and also corrected for multipath 

propagation effects on the signals. TDOA estimates from different pairs of cell sites are 

combined to derive the location estimate. It is well known that more accurate TDOA 
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estimates can be obtained by observing a wider bandwidth. It is generally not possible to 
increase the "instantaneous" bandwidth of the signal transmitted by a wireless transmitter, 
but it is possible to command a wireless transmitter to switch from one frequency channel 
to another so that, in a short time, a wide bandwidth can be observed. 

In a typical non-wireline cellular system, for example, channels 313-333 are control 
channels and the remaining 395 channels are voice channels. The center frequency of a 
wireless transmitter transmitting on voice RF channel number 1 (RVC 1) is 826.030 MHz 
and the center-to-center frequency spacing of successive channels of 0.030 MHz. The 
nuinber of voice channels assigned to each cell of a typical seven-cell frequ«icy-feuse 
block is about 57 (i.e., 395 divided by 7) and these channels are distributed throughout the 
395-chanriel range, spaced every 7 channels. Note then that each cell site used in an 
AMPS system has channels that span the entire 12.5 MHz band allocated by the FCC. If, 
for example, we designate cells of each frequency set in a re-u$e pattern as cells "A" 
through "G", the channel numbers assigned to the " A" cell(s) might be 1, 8, 15, 22, 
309; the numbers of the channels assigned to the "B" cells are determined by adding 1 to 
the "A" channel numbers; arid so on through G. 

The method begins when the wifeless transmitter has been assigned to a voice RF channel, 
arid the Wireless Location Systeiri has triggered location processing for the tranSinissions 
from the wireless transtriitter. As part of the location processing, the TDOA estimates 
TDOAn and TDOA 2 3 combined may have, for example* a sttodard deviation error of 0.5 
microsecond. The method combining measurements from different RF channels exploits 
the relation between TDOA, fringe phase, arid radio frequency. Denote the "true" value of 
the group delay or TDOA, i.e., the value that would be observed in the absence of noise, 
multipath, and any instrumental error, by t; similarly, denote the true value of fringe phase 
by <J); arid denote the radio frequency by f. The fringe phase <{> is related to t and f by: 

<t> = -fc + n (Eq. 1) 



107 



WO 00/41417 



PCT/US99/29462 



where (J> is measured in cycles, fin Hz and % in seconds; and n is an integer representing 
the intrinsic integer-cycle ambiguity of a doubly-differenced phase measurement. The 
value of n is unknown a priori but is the same for observations at contiguous frequencies, 
i.e., within any one frequency channel. The value of n is generally different for 
observations at separated frequencies, t can be estimated from observations in a single 
frequency channel is, in effect, by fitting a straight line to the fringe phase observed as a 
function of frequency within the channel. The slope of the best-fitting line equals minus 
the desired estimate of t. In the single-channel case, nis constant and so Eq, 1 can be 
differentiated to obtain: 

d<j>/df=-T (Eq, 2). 

Independent estimates of % are obtainable by straight-line fitting to the observations of § 
vs. f separately for each channel, but when two sep^iate (non-contiguous) frequency 
channels are observed, a single straight line will not generally fit the observations of <|> vs. 
f from both channels because, in general, the integer n has different values for the two 
channels. However, under certain conditions, it is possible to determine and remove the 
difference between these two integer values and then to fit a single straight line to the 
entire set of phase data spanning both channels. The slope of this straight line will be 
much better determined because it is based on a wider range of frequencies. Under certain 
conditions, the uncertainty of the slope estimate is inversely proportional to the frequency 
span. 

In tins example* suppose that the wirfcles RF 
channel 1. The radio frequency difference between channels 1 and 416 is so great that 
initially the difference between the integers n j and ru\6 corresponding to these channels 
cannot be determined. However, from the observations in either or both channels taken 
separately, an initial TDOA estimate To can be derived. Now the Wifeless Location 
System commands the wireless communications system to make the wireless transmitter 
to switch from channel 1 to channel 8. The wireless transmitter's signal is received in 
channel 8 and processed to update or refine the estimate t 0 . From to, the "theoretical 0 
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fringe-phase <|>o as a function of frequency can be computed, equal to (-fto). The difference 
between the actually observed phase <|> and the theoretical function <j>o can be computed, 
where the actually observed phase equals the true phase within a very small fraction, 
typically l/50th, of a cycle: 

5 

<)mJ>6 == -f (t-To) + n } or ng, depending on the channel (Eq. 3) 

or 

A<|> = -Aft-m or ng, depending on the channel (Eq. 4) 

10 where A<f» ^ <M*o and At ^T-t 0 , Equation (4) is graphed in Figure 12B, depictifig the 
difference, A<t>> between the observed fringe phase § arid the value fa computed from the 
initial TDOA estimate to, versus frequency f for channels 1 and 8. 

For the 20 KHz-wide band of frequencies corresponding to channel 1, a graph of A<j> vs. f 

15 is typically a horizontal straight line. For the 20 KHz-wide band of frequencies 

corresponding to channel 8, the graph of Af vsw f is also horizontal Straight line. The 
slopes of these line segments are generally nearly zero because the quantity (f At) usually 
does not vary by a significant fraction of a cycle within 20 KHz, b ecause At is minus the 
error of the estimate to, the magnitude of this error typically will not exceed 1,5 

20 microseconds (3 times the standard deviation of 0.5 microseconds in this example)* and 
the product of 1 .5 microseconds arid 20 KHz is under 4% of a cycle. In Figure 12B, the 
graph of A<|> for channel I is displaced vertically from the graph of A(J> for channel 8 by a 
relatively large amount because the difference between m and ng can be arbitrarily large/ 
this vertical displacement, Of difference between the average values of A§ for channels I 

25 and 8, will (with extremely high probability) be within ±03 cycle of the true value of the 
difference, m and ng, because the product of the maximum likely magnitude of At (1 .5 
microseconds) and the spacing of channels 1 and 8 (210 KHz) is GJ 15 cycle. In other 
words, the difference m - ng is equal to the difference between the average values of Af 
for channels 1 and 8, rounded to the nearest integer. After the integer difference m - rig is 

30 determined by this rounding procedure, the integer A<j> is added for channel 8 or subtracted 

from A<(> for channel 1. the difference between the average values of A<|> for channels 1 
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and 8 is generally equal to the error in the initial TDOA estimate, x 0 , times 210 KHz. the 
difference between the average values of A<|> for channels 1 arid 8 is divided by 210>KHz 
and the result is added to t 0 to obtain an estimate of t> the true value ofthe TDOA; this 
new estimate can be significantly more accurate than to. 

5 

This frequency-stepping and TDOA-refiriing method can be extended to more widely 
spaced channels to obtain yet more accurate results. If ti is used to represent the refined 
result obtained from channels 1 arid 8> t 0 can be replaced by ti in the just-described 
method; and the Wireless Location System can command the wircfess commuiiications 

10 system to make the wireless transmitter switch, e.g., from channel 8 to channel 36; thenti 
Qan be used to determine the integer difference n 8 - n 36 and a TDOA estimate can be 
obtained based on the 1 .05 MHz frequency span between channels 1 and 36. The 
estimated can be labeled x 2 ; and the wireless transmitter switched, e.g., from channel 36 to 
1 12, arid so On. In principle, the full range of frequencies allocated to the cellular carrier 

15 can be spanned. The channel numbers (1, 8, 36, 112) used in this example are, of course, 
arbitrary. The general principle is that an estimate of the TDOA based on a small 
frequency span (starting with a single channel) is used to resolve the integer ambiguity of 
the fringe phase difference between more widely separated frequencies. The latter 
frequency separation should not be too large; it is limited by the uncertainty ofthe prior 

20 estimate of TDOA. In general, the worst-case error in the prior estimate multiplied by the 
frequency difference may not exceed 0.5 cycle. 

If the very smallest (e.g., 210 KHz) frequency gap between the most closely spaced 
channels allocated to a particular cell cannot be bridged because the worst-case 

25 uncertainty of the single-channel TDOA estimate exceeds 2.38 iiiieroseconds (equal to 0.5 
cycle divided by 0.210 MHz), the Wireless Location System colirinands the wireless 
communications system to force the wireless transmitter hand-off from one cell site to 
another (e.g. from one frequency group to ariother), such that the frequency step is smaller. 
There is a possibility of misidentifyirig the integer difference between the phase 

30 differences (A(|>'s) for two channels, e.g., because the wireless transmitter moved during 
the handoff from one channel to the other. Therefore, as a check, the Wireless Location 
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System may reverse each handoff (e.g., after switching from channel 1 to chafinel 8, 
switch from channel 8 back to channel 1) and confirm that the integer-cycle difference 
determined has precisely the same magnitude and the opposite sign as for the "forward 
hand-off. A significantly nonzero velocity estimate from the single-channel FDOA 
5 observations can be used to extrapolate across the time interval involved in a channel 
change. Ordinarily this time interval can be held to a small fraction of 1 second. The 
FDOA estimation error multiplied by the time interval between channels must be small in 
comparison with 0.5 cycle, the Wireless Location System preferably employs a variety of 
redundancies and checks against integer-misidentificatioti. 

io • . " ' , " ." . .i. 

Directed Retry for 911 

Another inventive aspect of the Wireless Location System relates to a "directed retry" 
method for use in connection with dual-mode wireless communications systems 
supporting at least a first modulation method and a second modulation method. The dual- 

15 mode wireless communications systems may include any of the following scenarios: a 
single wireless carrier operating at least two modulation methods in the same frequency 
band, a single wireless carrier operating at least two modulation methods in two different 
frequency bands, or two different wireless carriers operating at least two modulation 
methods in two different frequency bands. In each such situation, the first and second 

20 modulation methods are generally used on different RF ctomiels within the same or 
different frequency bands (for example, a cellular carrier may use some RF channels for 
AMPS and some RF channels for TDMA). It is assumed that the wireless transmitter to be 
located is capable of supporting both modulation methods and so is capable of dialing * 
"911 11 on the RF channels of the wireless communications system having Wireless 

25 Location System support. 

For example, the directed retry method could be used with a wireless communications a 
system in which there are an insufficient number of base stations to economically support 
a Wireless Location System, but which is operating in a region served by a Wireless 
30 Location System associated with another wireless cOinmUnicatiohs system, A "first" 
wireless communications system could be a cellular telephone system and a "second" 
wireless communications system could be a PCS system operating within the same 
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territory as the first system, According to the invention* when the wireless transmitter is 
currently using the second (PCS) modulation method and attempts to originate a call to 
91 1, the wireless transmitter is caused to switch automatically to the first modulation 
method, and then to originate the call to 91 1 using the first modulation method on one of 
5 the set of KF channels prescribed for use by the first wireless communications system. In 
this manner, location services can be provided to customers of a PCS or like system that is 
not served by its own Wireless Location System. 

Conclusion 

10 The true scope the present invention is not limited to the presently preferred embodiments 
disclosed herein. For example, the foregoing disclosure of a presently preferred 
embodiment of a Wireless Location System uses explanatory terms, such as Signal 
Collection System (SCS), TDOA Location Processor (TLP), Applications Processor (AP), 
and the like, which should not be construed so as to limit the scope of protection of the; 

15 following claims* or to othetwise imply that the inventive aspects of the Wireless Location 
System are limited to the particular methods and apparatos discldsedi Moreover, as will be 
understood by those skilled in the art, many of the inventive aspects disclosed herein may 
be applied in location systems that are fiot based on TDOA techniques. For example, the 
processes by which the Wireless Location System uses the Tasking List, etc. can be 

20 applied to non-TDOA systems. In such ndn-TDOA systems, the TLFs described above 
would not be required to perform TDOA calculations. Similarly, the invention is not 
limited to systems employing SCS f s constructed as described above, nor to systems 
employing AFs meeting all of the particulars described abbv^. The SCS's, TLP's and AFs 
are, in essence, programmable data collection and processing devices that could take a 

25 variety of forms without departing from the inventive concepts disclosed herein. Given the 
rapidly declining cost of digital signal processing and other processing functions, it is 
easily possible, for example, to transfer the processing for a particular function from one 
of the functional elements (such as the TLP) described herein to another ftoctibnal 
element (such as the SCS or AP) without changing the inventive operation of the system. 

30 in many cases, the place of implementation (i.e. the functional element) described herein 
is merely a designer's preference and not a hard requirement. Accordingly, except as they 
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may be expressly so limited, the scope of protection of the following claims is not 
intended to be limited to the specific embo^ described above. 
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CLAIMS 

What is claimed is: 

1 . A method for use in dual mode wireless communications systems, operated by one of 
more wireless carriers* supporting at least a first modulation method and a second 
5 modulation method, wherein the first and second modulation methods ^e used on 
different RF channels, wherein a wireless transmitter is capable of supporting both 
modulation methods, and wherein it is preferred that emergency 911 calls generally take 
place with the first modulation method* comprising the steps of; 
when the lyireles^tf 

10 attempts to originate a call to 91 1 , caiisirig the wireteSstfk^ to 

switch to the first modulation method; and 
originating the call to 911 using the first modulation method on one of the set of RF 
channels prescribed for use in the first modulation method. 

15 2. A method as recited in claim 1, wherein a mobile swtching center (MSC) detects the 
call origination occurring from the wireless tr^sinitter using the second modulation 
method, and commands the wireless transmitter to retry the Call using the first modulation 
method. 

20 3. A method as recited in claim % wherein the wireless MSG first verifies that one of the 
RF channels prescribed for use by the first modulation method is available for use by the 
wireless transmitter before directing the wifeless transmitter to retry the call, arid 
otherwise the wireless MSC does not cause the wireless transmitter to retry the call. 

25 4. A method as recited in claim 1, wherein the wifelesis transmitter detects that a user or 
subscriber has dialed 91 1 and if the wireless transmitter is currently using the second 
modulation method, the wireless transmitter switches to the first modulation method arid 
then makes a call origination transmission. 

3D 5. A method as recited in claim 1, wherein the wireless transmitter fifst scans theRF 

channels prescribed for use by the first modulation method to Verify that such channels 

are in active use by the wireless communications system; and, if the channels are in 
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active use, the wireless transmitter originates the 911 call on an RF channel prescribed 
for use by the first modulation method. 

6. A method as recited in claim 1 , wherein, if the 91 1 call cannot be completed using the 
first modulation method within a predetermined amount of time, the wireless transmitter 
tries to complete the 911 origination using the RF channels prescribed for use by the 
second modulation method. 

7. A Wireless Location System employing a "directed retry" method for use in 
connection with dual-mode wireless communications systems supporting at least a first 
modulation method and a second modulation method, wherein the first and second 
modulation methods are used on different RF channels, such as Channels for the wireless 
communications system supporting the WLS and a PCS ^stem, respectively, and 
wherein a wireless transmitter to be located is capable of supporting both modulation 
methods, wherein the "directed retry" method comprises the step of, when the wireless 
transmitter is currently using the PCS modulation method and attempts to originate a call 
to 91 1, the wireless transmitter is caused to ^ 

method, and then to originate the ball to 911 using the first mb^niation method on one of 
the set of RF channels prescribed for use by the wireless communications system, 
whereby location services can be provided to customers of a PCS or like system that is 
not served by its own Wireless Location System, 

8, A Wireless Location System as recited in claim 7, wherein a mobile switching center 
(MSC) detects the call origination occurring from the wireless transmitter using the 
second modulation method, and commands the wireless transmitter to retry the call using 
the first modulation method. 

9, A Wireless Location System as recited in claim 8, wherein the wireless MSC first 
verifies that one of the RF channels prescribed for use by the first modulation method is 
available for use by the wireless transmitter before directing the wireless transmitter to 
retry the call, and otherwise the MSC does not cause the wireless transmitter to retry the 
call. 
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10. A Wireless Lo^ 

detects that a user or subscriber has dialed 911 and if the wireless transmitter is currently 
using the second modulation method, the wifeless transmitter switches to the first 
5 modulation method and then makes a call origination transmission. 

11. A Wireless Location System as recited in claim 7, Wherein the wireless transmitter 
first scans the RF channels prescribed for use by the first modulation method to verify 
that such channels are in active use by the wireless communications system; and, if the 

10 channels Sfe in active use, the wireless tranismittef originates the 911 call on an RF 
channel prescribed for use by the first modulation method. 

12. A Wireless Location System as recited in Claim 7, wherein, if the 911 call cannot be 
completed using the first modulation method within a predetermined amount of time, the 

15 wireless transmitter tries to coinplete the 911 origination using the RF channels 
prescribed for use by the second mM^ 
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